Description

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Remediation

References

https://github.com/undertow-io/undertow/pull/794

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10184

https://access.redhat.com/errata/RHSA-2019:2937

https://access.redhat.com/errata/RHSA-2019:2936

https://access.redhat.com/errata/RHSA-2019:2935

https://access.redhat.com/errata/RHSA-2019:2938

https://access.redhat.com/errata/RHSA-2019:2998

https://access.redhat.com/errata/RHSA-2019:3046

https://access.redhat.com/errata/RHSA-2019:3045

https://access.redhat.com/errata/RHSA-2019:3044

https://access.redhat.com/errata/RHSA-2019:3050

https://access.redhat.com/errata/RHSA-2020:0727

https://security.netapp.com/advisory/ntap-20220210-0016/

Related Vulnerabilities

CVE-2021-3827 Vulnerability in maven package org.keycloak:keycloak-services

CVE-2023-5104 Vulnerability in npm package nocodb

CVE-2022-27340 Vulnerability in maven package net.mingsoft:ms-mcms

CVE-2020-28487 Vulnerability in maven package org.webjars.bowergithub.visjs:vis-timeline

CVE-2019-9154 Vulnerability in npm package openpgp

Severity

High

Classification

CWE-862 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Patch Third Party Advisory Issue Tracking Vendor Advisory