CVE-2018-1047

20

FAUCET Score

CVE-2018-1047 is a path traversal vulnerability in Wildfly 9.x, specifically within the ServletResourceManager.getResource method, which can lead to information disclosure of arbitrary local files. This medium-severity flaw (CVSS 5.5) allows an authenticated local attacker to read sensitive data without requiring user interaction. While the vulnerability affects Red Hat Enterprise Linux, JBoss EAP, and JBoss Wildfly, there is currently no known active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		9.0.0CPE matchmatch criteria	cpe:2.3:a:redhat:jboss_wildfly_application_server:9.0.0:::::::*
		9.0.0CPE matchmatch criteria	cpe:2.3:a:redhat:jboss_wildfly_application_server:9.0.0:alpha1::::::
		9.0.0CPE matchmatch criteria	cpe:2.3:a:redhat:jboss_wildfly_application_server:9.0.0:beta1::::::
		9.0.0CPE matchmatch criteria	cpe:2.3:a:redhat:jboss_wildfly_application_server:9.0.0:beta2::::::
		9.0.0CPE matchmatch criteria	cpe:2.3:a:redhat:jboss_wildfly_application_server:9.0.0:cr1::::::

CVSS Data

CVSS version used by this source: 3.0

5.5MEDIUM

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Exploitability Score

1.8

Impact Score

3.6

CvssVersion

3.0

Exploit Intelligence

EPSS Score

0.49%

Probability of exploitation in next 30 days

EPSS Percentile

39.3%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

This CVE's current EPSS score of 0.0049 is in the 92nd percentile among its peer group of 15,940 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (53)

mavenpatch availablevia ghsa

Product: org.wildfly:wildfly-undertowFixed in: 12.0.0

redhatpatch availablevia redhat_api

Product: Red Hat JBoss EAP 7.1

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-activemq-artemis-0:1.5.5.010-1.redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-hibernate-0:5.1.13-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-infinispan-0:8.2.10-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-ironjacamar-0:1.4.8-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-jboss-ejb-client-0:4.0.10-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-jboss-jsf-api_2.2_spec-0:2.2.13-5.SP2_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-jboss-marshalling-0:2.0.4-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-jboss-server-migration-0:1.0.4-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-jboss-weld-2.2-api-0:2.4.0-3.SP2_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-jboss-xnio-base-0:3.5.5-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-jgroups-0:3.6.14-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-mod_cluster-0:1.3.9-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-picketbox-0:5.0.3-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-picketlink-bindings-0:2.5.5-11.SP10_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-picketlink-federation-0:2.5.5-11.SP10_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-undertow-0:1.4.18-5.SP5_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-weld-core-0:2.4.7-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-wildfly-0:7.1.2-1.GA_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-wildfly-elytron-0:1.1.9-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-wildfly-elytron-tool-0:1.0.6-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-wildfly-javadocs-0:7.1.2-1.GA_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-wildfly-web-console-eap-0:2.9.16-2.Final_redhat_1.2.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-jboss-ec2-eap-0:7.1.2-1.GA_redhat_1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-activemq-artemis-0:1.5.5.010-1.redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-hibernate-0:5.1.13-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-infinispan-0:8.2.10-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-ironjacamar-0:1.4.8-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-jboss-ejb-client-0:4.0.10-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-jboss-jsf-api_2.2_spec-0:2.2.13-5.SP2_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-jboss-marshalling-0:2.0.4-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-jboss-server-migration-0:1.0.4-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-jboss-weld-2.2-api-0:2.4.0-3.SP2_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-jboss-xnio-base-0:3.5.5-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-jgroups-0:3.6.14-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-mod_cluster-0:1.3.9-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-picketbox-0:5.0.3-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-picketlink-bindings-0:2.5.5-11.SP10_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-picketlink-federation-0:2.5.5-11.SP10_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-weld-core-0:2.4.7-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-wildfly-0:7.1.2-1.GA_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-wildfly-elytron-0:1.1.9-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-wildfly-elytron-tool-0:1.0.6-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-wildfly-javadocs-0:7.1.2-1.GA_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-wildfly-web-console-eap-0:2.9.16-2.Final_redhat_1.2.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-jboss-ec2-eap-0:7.1.2-1.GA_redhat_1.ep7.el7

redhatpatch availablevia redhat_api

Product: Text-Only RHOAR

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-undertow-0:1.4.18-5.SP5_redhat_1.1.ep7.el7

redhatno patchvia redhat_api

Product: Red Hat Fuse 7Fixed in: undertow

redhatno patchvia redhat_api

Product: Red Hat JBoss Fuse Integration Service 2Fixed in: undertow

redhatno patchvia redhat_api

Product: Red Hat OpenShift Application RuntimesFixed in: undertow

redhatend of lifevia redhat_api

Product: Red Hat JBoss Fuse 6Fixed in: undertow

Vendor Advisories (2)

mavenGHSA-fmr4-w67p-vh8xmedium

Improper Input Validation in org.wildfly:wildfly-undertow

redhatCVE-2018-1047Moderate

undertow: Path traversal in ServletResourceManager class

References

access.redhat.com / errata/RHSA-2018:1247

Third Party Advisory

access.redhat.com / errata/RHSA-2018:1248

Third Party Advisory

access.redhat.com / errata/RHSA-2018:1249

Third Party Advisory

access.redhat.com / errata/RHSA-2018:1251

Third Party Advisory

access.redhat.com / errata/RHSA-2018:2938

Third Party Advisory

bugzilla.redhat.com / show_bug.cgi

Issue TrackingThird Party Advisory

issues.jboss.org / browse/WFLY-9620

Issue TrackingVendor Advisory