-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.wildfly:wildfly-parent | maven | >= 8.1.0.Final, <= 9.0.0.CR1 | 9.0.0.CR2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from Undertow's DefaultServlet not handling trailing slashes in JSP URLs. The fix (visible in WFLY-4595 and related PRs) added a path validation check in DefaultServlet.service() to reject requests ending with '/'. The vulnerable versions lacked this check, allowing JSP source disclosure by appending '/' to URLs. This matches the CWE-200 exposure pattern and is confirmed by community analysis showing the added path.endsWith("/") guard clause as the mitigation.