CVE-2018-1306

CVE-2018-1306 describes a sensitive information disclosure vulnerability in the PortletV3AnnotatedDemo Multipart Portlet war file within Apache Pluto version 3.0.0. This flaw allows a remote attacker to obtain configuration data and other sensitive information by exploiting a failure to restrict path information during file uploads. With a CVSS score of 7.5 (High), the vulnerability is easily exploitable over the network without authentication, leading to high confidentiality impact. While not actively exploited in the wild and lacking significant community discussion or media coverage, an exploit for Remote Code Execution (EDB-45396) is publicly available, indicating a potential for exploitation.