CVE-2017-2595

It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows...

7.7 HighFix available

It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via path traversal.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

3.06%Down 0.4 points since Apr 14, 2021

What each source reports

CVE List Score used 7.7

It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via path traversal.

Record: CVE-2017-2595
CVSS 3.0: 7.7 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2017-11771 7.7

It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via path traversal.

Record: EUVD-2017-11771
CVSS 3.0: 7.7 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-94q8-x74c-h24h 6.5

It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows...

It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via path traversal.

Record: GHSA-94q8-x74c-h24h
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

NVD 7.7

It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via path traversal.

Record: CVE-2017-2595
CVSS 3.0: 7.7 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness: CWE-22
Updated: 2026-11-02

OSVRHSA-2017:1410 8.1

Red Hat Security Advisory: JBoss Enterprise Application Platform 7.0.6 on Red Hat Enterprise Linux 6

Record: RHSA-2017:1410
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2017:1411 8.1

Red Hat Security Advisory: JBoss Enterprise Application Platform 7.0.6 on Red Hat Enterprise Linux 7

Record: RHSA-2017:1411
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 8 moreShow less

OSVRHSA-2017:1412 8.1

Red Hat Security Advisory: eap7-jboss-ec2-eap security update

Record: RHSA-2017:1412
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2017:1548 7.7

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.16 update on RHEL 7

Record: RHSA-2017:1548
CVSS 3.0: 7.7 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2017:1549 7.7

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.16 update on RHEL 6

Record: RHSA-2017:1549
CVSS 3.0: 7.7 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2017:1550 7.7

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.16 update on RHEL 5

Record: RHSA-2017:1550
CVSS 3.0: 7.7 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2017:1552 7.7

Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update

Record: RHSA-2017:1552
CVSS 3.0: 7.7 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2017:3454 8.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.0 security update

Record: RHSA-2017:3454
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2017:3455 8.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.0 security update

Record: RHSA-2017:3455
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2017:3458 8.1

Red Hat Security Advisory: eap7-jboss-ec2-eap security update

Record: RHSA-2017:3458
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`eap7-activemq-artemis` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.1.0-17.SP20_redhat_1.1.ep7.el6	0:1.1.0-17.SP20_redhat_1.1.ep7.el6
`eap7-activemq-artemis-cli` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.1.0-17.SP20_redhat_1.1.ep7.el6	0:1.1.0-17.SP20_redhat_1.1.ep7.el6
`eap7-activemq-artemis-commons` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.1.0-17.SP20_redhat_1.1.ep7.el6	0:1.1.0-17.SP20_redhat_1.1.ep7.el6
`eap7-activemq-artemis-core-client` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.1.0-17.SP20_redhat_1.1.ep7.el6	0:1.1.0-17.SP20_redhat_1.1.ep7.el6
`eap7-activemq-artemis-dto` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.1.0-17.SP20_redhat_1.1.ep7.el6	0:1.1.0-17.SP20_redhat_1.1.ep7.el6
`eap7-activemq-artemis-hornetq-protocol` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.1.0-17.SP20_redhat_1.1.ep7.el6	0:1.1.0-17.SP20_redhat_1.1.ep7.el6
`eap7-activemq-artemis-hqclient-protocol` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.1.0-17.SP20_redhat_1.1.ep7.el6	0:1.1.0-17.SP20_redhat_1.1.ep7.el6
`eap7-activemq-artemis-jms-client` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.1.0-17.SP20_redhat_1.1.ep7.el6	0:1.1.0-17.SP20_redhat_1.1.ep7.el6
`eap7-activemq-artemis-jms-server` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.1.0-17.SP20_redhat_1.1.ep7.el6	0:1.1.0-17.SP20_redhat_1.1.ep7.el6
`eap7-activemq-artemis-journal` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.1.0-17.SP20_redhat_1.1.ep7.el6	0:1.1.0-17.SP20_redhat_1.1.ep7.el6

Show 290 moreShow less

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, products	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-2595 is a high vulnerability (CVSS 7.7) in [unknown] Wildfly, published July 27, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.06%, the 87th percentile. Fixed in eap7-activemq-artemis 0:1.1.0-17.SP20_redhat_1.1.ep7.el6.

References

Show 119 moreShow less

This page doesn't list everything

Left out here: 459 package rows. The JSON record has them. Also not on the record: 281 package claims. ID and package lookups still check them.

Affected packages
Package	Affected	Fixed
`eap7-activemq-artemis-native` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.1.0-17.SP20_redhat_1.1.ep7.el6	0:1.1.0-17.SP20_redhat_1.1.ep7.el6
`eap7-activemq-artemis-ra` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.1.0-17.SP20_redhat_1.1.ep7.el6	0:1.1.0-17.SP20_redhat_1.1.ep7.el6
`eap7-activemq-artemis-selector` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.1.0-17.SP20_redhat_1.1.ep7.el6	0:1.1.0-17.SP20_redhat_1.1.ep7.el6
`eap7-activemq-artemis-server` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.1.0-17.SP20_redhat_1.1.ep7.el6	0:1.1.0-17.SP20_redhat_1.1.ep7.el6
`eap7-activemq-artemis-service-extensions` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.1.0-17.SP20_redhat_1.1.ep7.el6	0:1.1.0-17.SP20_redhat_1.1.ep7.el6
`eap7-apache-cxf` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:3.1.10-2.redhat_1.1.ep7.el6	0:3.1.10-2.redhat_1.1.ep7.el6
`eap7-apache-cxf-rt` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:3.1.10-2.redhat_1.1.ep7.el6	0:3.1.10-2.redhat_1.1.ep7.el6
`eap7-apache-cxf-services` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:3.1.10-2.redhat_1.1.ep7.el6	0:3.1.10-2.redhat_1.1.ep7.el6
`eap7-apache-cxf-tools` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:3.1.10-2.redhat_1.1.ep7.el6	0:3.1.10-2.redhat_1.1.ep7.el6
`eap7-commons-logging-jboss-logmanager` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.0.0-1.Final_redhat_1.1.ep7.el6	0:1.0.0-1.Final_redhat_1.1.ep7.el6
`eap7-glassfish-javamail` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.5.5-2.redhat_2.1.ep7.el6	0:1.5.5-2.redhat_2.1.ep7.el6
`eap7-hibernate` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:5.0.13-1.Final_redhat_1.1.ep7.el6	0:5.0.13-1.Final_redhat_1.1.ep7.el6
`eap7-hibernate-core` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:5.0.13-1.Final_redhat_1.1.ep7.el6	0:5.0.13-1.Final_redhat_1.1.ep7.el6
`eap7-hibernate-entitymanager` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:5.0.13-1.Final_redhat_1.1.ep7.el6	0:5.0.13-1.Final_redhat_1.1.ep7.el6
`eap7-hibernate-envers` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:5.0.13-1.Final_redhat_1.1.ep7.el6	0:5.0.13-1.Final_redhat_1.1.ep7.el6
`eap7-hibernate-infinispan` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:5.0.13-1.Final_redhat_1.1.ep7.el6	0:5.0.13-1.Final_redhat_1.1.ep7.el6
`eap7-hibernate-java8` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:5.0.13-1.Final_redhat_1.1.ep7.el6	0:5.0.13-1.Final_redhat_1.1.ep7.el6
`eap7-hibernate-validator` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:5.2.5-1.Final_redhat_1.1.ep7.el6	0:5.2.5-1.Final_redhat_1.1.ep7.el6
`eap7-hibernate-validator-cdi` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:5.2.5-1.Final_redhat_1.1.ep7.el6	0:5.2.5-1.Final_redhat_1.1.ep7.el6
`eap7-infinispan` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:8.1.8-1.Final_redhat_1.1.ep7.el6	0:8.1.8-1.Final_redhat_1.1.ep7.el6
`eap7-infinispan-cachestore-jdbc` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:8.1.8-1.Final_redhat_1.1.ep7.el6	0:8.1.8-1.Final_redhat_1.1.ep7.el6
`eap7-infinispan-cachestore-remote` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:8.1.8-1.Final_redhat_1.1.ep7.el6	0:8.1.8-1.Final_redhat_1.1.ep7.el6
`eap7-infinispan-client-hotrod` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:8.1.8-1.Final_redhat_1.1.ep7.el6	0:8.1.8-1.Final_redhat_1.1.ep7.el6
`eap7-infinispan-commons` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:8.1.8-1.Final_redhat_1.1.ep7.el6	0:8.1.8-1.Final_redhat_1.1.ep7.el6
`eap7-infinispan-core` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:8.1.8-1.Final_redhat_1.1.ep7.el6	0:8.1.8-1.Final_redhat_1.1.ep7.el6
`eap7-ironjacamar` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.3.6-2.Final_redhat_2.1.ep7.el6	0:1.3.6-2.Final_redhat_2.1.ep7.el6
`eap7-ironjacamar-common-api` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.3.6-2.Final_redhat_2.1.ep7.el6	0:1.3.6-2.Final_redhat_2.1.ep7.el6
`eap7-ironjacamar-common-impl` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.3.6-2.Final_redhat_2.1.ep7.el6	0:1.3.6-2.Final_redhat_2.1.ep7.el6
`eap7-ironjacamar-common-spi` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.3.6-2.Final_redhat_2.1.ep7.el6	0:1.3.6-2.Final_redhat_2.1.ep7.el6
`eap7-ironjacamar-core-api` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.3.6-2.Final_redhat_2.1.ep7.el6	0:1.3.6-2.Final_redhat_2.1.ep7.el6
`eap7-ironjacamar-core-impl` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.3.6-2.Final_redhat_2.1.ep7.el6	0:1.3.6-2.Final_redhat_2.1.ep7.el6
`eap7-ironjacamar-deployers-common` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.3.6-2.Final_redhat_2.1.ep7.el6	0:1.3.6-2.Final_redhat_2.1.ep7.el6
`eap7-ironjacamar-jdbc` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.3.6-2.Final_redhat_2.1.ep7.el6	0:1.3.6-2.Final_redhat_2.1.ep7.el6
`eap7-ironjacamar-validator` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.3.6-2.Final_redhat_2.1.ep7.el6	0:1.3.6-2.Final_redhat_2.1.ep7.el6
`eap7-jboss-ejb-client` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:2.1.8-1.Final_redhat_1.1.ep7.el6	0:2.1.8-1.Final_redhat_1.1.ep7.el6
`eap7-jboss-el-api_3.0_spec` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:1.0.8-1.Final_redhat_1.1.ep7.el6	0:1.0.8-1.Final_redhat_1.1.ep7.el6
`eap7-jboss-logging` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:3.3.1-1.Final_redhat_1.1.ep7.el6	0:3.3.1-1.Final_redhat_1.1.ep7.el6
`eap7-jboss-metadata` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:10.0.1-1.Final_redhat_1.1.ep7.el6	0:10.0.1-1.Final_redhat_1.1.ep7.el6
`eap7-jboss-metadata-appclient` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:10.0.1-1.Final_redhat_1.1.ep7.el6	0:10.0.1-1.Final_redhat_1.1.ep7.el6
`eap7-jboss-metadata-common` Red Hat:jboss_enterprise_application_platform:7::el6	before 0:10.0.1-1.Final_redhat_1.1.ep7.el6	0:10.0.1-1.Final_redhat_1.1.ep7.el6