Description
Directory traversal vulnerability in the DeploymentFileRepository class in JBoss Application Server (jbossas) 3.2.4 through 4.0.5 allows remote authenticated users to read or modify arbitrary files, and possibly execute arbitrary code, via unspecified vectors related to the console manager.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 1 | jbossas | 4.0.4-1.el4s1.25 | RHSA-2006:0743 |
Advisories 1
- RHSA-2006:0743 Red Hat Security Advisory: jbossas security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 23984 third-party-advisory
- ADV-2008-1155 vdb-entry
- SSRT080018 vendor-advisory
- RHSA-2006:0743 vendor-advisory
- 30767 vdb-entry
- 21219 vdb-entry
- ADV-2006-4724 vdb-entry
- 23095 third-party-advisory
- 29726 third-party-advisory
- 20061128 Re: SYMSA-2006-011: JBoss Java Class DeploymentFileRepository Directory Traversal mailing-list
- http://jira.jboss.com/jira/browse/ASPATCH-126
- https://secure-support.novell.com/KanisaPlatform/Publishing/719/3024921_f.SAL_Public.html
- 1017289 vdb-entry
- SUSE-SR:2007:002 vendor-advisory
- ADV-2007-0554 vdb-entry
- ADV-2006-4726 vdb-entry
- 24104 third-party-advisory
- 20061127 SYMSA-2006-011: JBoss Java Class DeploymentFileRepository Directory Traversal mailing-list
- http://jira.jboss.com/jira/browse/JBAS-3861