CVE-2018-10682

An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication using "anonymous" access that is automatically created. Once logged in, a misconfiguration present by default (auto-deployment) permits an anonymous user to deploy a malicious .war file, leading to remote code execution. NOTE: the vendor indicates that anonymous access is not available in the default installation; however, it remains optional because there are several use cases for it, including development environments and network architectures that have a proxy server for access control to the WildFly server

• CWE-287
• CWE-287

• https://github.com/kmkz/exploit/blob/master/CVE-2018-10682-CVE-2018-10683.txtExploit, Third Party Advisory
• https://github.com/kmkz/exploit/blob/master/CVE-2018-10682-CVE-2018-10683.txtExploit, Third Party Advisory

Published

May 9, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10675The do_get_mempolicy function in mm/mempolicy.c in the Linux…7.8
• CVE-2018-10676CeNova, Night OWL, Novo, Pulnix, QSee, Securus, and TBK Visi…
• CVE-2018-10677The DecodeGifImg function in ngiflib.c in MiniUPnP ngiflib 0…
• CVE-2018-10678MyBB 1.8.15, when accessed with Microsoft Edge, mishandles '…
• CVE-2018-1068A flaw was found in the Linux 4.x kernel's implementation of…6.7
• CVE-2018-10680Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerabil…
• CVE-2018-10683An issue was discovered in WildFly 10.1.2.Final. In the case…9.8
• CVE-2018-10685In Long Range Zip (aka lrzip) 0.631, there is a use-after-fr…
• CVE-2018-10686An issue was discovered in Vesta Control Panel 0.9.8-20. The…
• CVE-2018-10689blktrace (aka Block IO Tracing) 1.2.0, as used with the Linu…
• CVE-2018-1069Red Hat OpenShift Enterprise version 3.7 is vulnerable to ac…
• CVE-2018-10690An issue was discovered on Moxa AWK-3121 1.14 devices. The d…8.1