High severity7.5NVD Advisory· Published Jul 21, 2017· Updated May 13, 2026
CVE-2015-3198
CVE-2015-3198
Description
The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.wildfly:wildfly-parentMaven | >= 8.1.0.Final, < 9.0.0.CR2 | 9.0.0.CR2 |
Affected products
3cpe:2.3:a:redhat:jboss_wildfly_application_server:9.0.0:beta1:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:redhat:jboss_wildfly_application_server:9.0.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_wildfly_application_server:9.0.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:redhat:jboss_wildfly_application_server:9.0.0:cr1:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party AdvisoryWEB
- developer.jboss.org/message/927301nvdIssue TrackingThird Party AdvisoryWEB
- github.com/advisories/GHSA-4vwv-x3gp-2j4gghsaADVISORY
- issues.jboss.org/browse/WFLY-4595nvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2015-3198ghsaADVISORY
- stackoverflow.com/questions/30028346/with-trailing-slash-in-url-jsp-show-source-codenvdThird Party AdvisoryWEB
News mentions
0No linked articles in our index yet.