Description

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Remediation

References

https://github.com/undertow-io/undertow/pull/794

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10184

https://access.redhat.com/errata/RHSA-2019:2937

https://access.redhat.com/errata/RHSA-2019:2936

https://access.redhat.com/errata/RHSA-2019:2935

https://access.redhat.com/errata/RHSA-2019:2938

https://access.redhat.com/errata/RHSA-2019:2998

https://access.redhat.com/errata/RHSA-2019:3046

https://access.redhat.com/errata/RHSA-2019:3045

https://access.redhat.com/errata/RHSA-2019:3044

https://access.redhat.com/errata/RHSA-2019:3050

https://access.redhat.com/errata/RHSA-2020:0727

https://security.netapp.com/advisory/ntap-20220210-0016/

Related Vulnerabilities

CVE-2021-32808 Vulnerability in npm package ckeditor4

CVE-2018-7651 Vulnerability in maven package org.webjars.npm:ssri

CVE-2022-25179 Vulnerability in maven package org.jenkins-ci.plugins.workflow:workflow-multibranch

CVE-2018-25031 Vulnerability in maven package org.webjars.npm:swagger-ui

CVE-2018-1000873 Vulnerability in maven package com.fasterxml.jackson.datatype:jackson-datatype-jsr310

Severity

High

Classification

CWE-862 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Patch Third Party Advisory Issue Tracking Vendor Advisory