{"cve":"CVE-2018-10682","nvd":{"published":"2018-05-09T08:29:00.207","modified":"2026-06-17T01:34:29.847","status":"Modified","description":"An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication using \"anonymous\" access that is automatically created. Once logged in, a misconfiguration present by default (auto-deployment) permits an anonymous user to deploy a malicious .war file, leading to remote code execution. NOTE: the vendor indicates that anonymous access is not available in the default installation; however, it remains optional because there are several use cases for it, including development environments and network architectures that have a proxy server for access control to the WildFly server","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-287"],"references":["https://github.com/kmkz/exploit/blob/master/CVE-2018-10682-CVE-2018-10683.txt","https://github.com/kmkz/exploit/blob/master/CVE-2018-10682-CVE-2018-10683.txt"],"products":["wildfly:wildfly"],"source":"nvd","synced_at":"2026-10-19T20:50:40.212176939+00:00"},"epss":{"cve":"CVE-2018-10682","score":0.08103,"percentile":0.94822,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}