Description

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.

Remediation

References

CVE-2017-12196

Related Vulnerabilities

Oracle Application Server Other Vulnerability (CVE-2005-1495)

Oracle JRE CVE-2023-21967 Vulnerability (CVE-2023-21967)

WordPress Plugin Responsive Notification Bar for WordPress-Apex Notification Bar Lite includes Backdoor [Only if downloaded via the vendor website] (2.0.4)

Oracle Database Server Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2006-1868)

WordPress Plugin W3 Total Cache Multiple Vulnerabilities (0.9.4.1)

Severity

Medium

Classification

CVE-2017-12196 CWE-863 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities