Description
WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.
Remediation
References
https://access.redhat.com/errata/RHSA-2018:2276
https://access.redhat.com/errata/RHSA-2018:2277
https://access.redhat.com/errata/RHSA-2018:2279
https://access.redhat.com/errata/RHSA-2018:2423
https://access.redhat.com/errata/RHSA-2018:2424
https://access.redhat.com/errata/RHSA-2018:2425
https://access.redhat.com/errata/RHSA-2018:2428
https://access.redhat.com/errata/RHSA-2018:2643
https://access.redhat.com/errata/RHSA-2019:0877
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10862
https://snyk.io/research/zip-slip-vulnerability
Related Vulnerabilities
CVE-2022-22880 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-base-core
CVE-2017-5656 Vulnerability in maven package org.apache.cxf:cxf-rt-ws-security
CVE-2022-46684 Vulnerability in maven package com.checkmarx.jenkins:checkmarx
CVE-2022-34778 Vulnerability in maven package org.jenkins-ci.plugins:testng-plugin
CVE-2019-17638 Vulnerability in maven package org.eclipse.jetty:jetty-server