description: A flaw was found in Red Hat JBoss Core Services HTTP Server in all versions, where it does not properly normalize the path component of a request URL contains dot-dot-semicolon(s). This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
problem types: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
product: Red Hat JBCS HTTP Server
vendor: n/a
versions:
status: affected, version: Fixed in jbcs-httpd-2.4.37.SP10 GA
}