Description
It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the information disclosure of arbitrary local files.
Remediation
References
Related Vulnerabilities
Oracle Database Server Permissions, Privileges, and Access Controls Vulnerability (CVE-2016-5499)
WordPress Plugin Visual Form Builder Cross-Site Scripting (2.8.4)
WordPress Plugin WP Clone by WP Academy Cross-Site Scripting (2.1.1)
WordPress Plugin Snazzy Archives Cross-Site Scripting (1.7.1)
WordPress Plugin KittyCatfish Ads by Missilesilo SQL Injection (2.2)