high7.5
CVE-2019-10184
Undertow Missing Authorization when requesting a protected directory without trailing slash
Impact
undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.undertow:undertow-servlet | < 2.0.23 | 2.0.23 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Undertow | before 2.0.23 |
| Redhat | Jboss Data Grid | All versions |
| Redhat | Jboss Enterprise Application Platform | All versions Versions 7.0.0, 7.2, 7.3, 7.4 |
| Redhat | Openshift Application Runtimes | All versions Version 1.0 |
| Redhat | Single Sign-On | All versions Versions 7.0, 7.3 |
| Netapp | Active Iq Unified Manager | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/errata/RHSA-2019:2935
- https://access.redhat.com/errata/RHSA-2019:2936
- https://access.redhat.com/errata/RHSA-2019:2937
- https://access.redhat.com/errata/RHSA-2019:2938
- https://access.redhat.com/errata/RHSA-2019:2998
- https://access.redhat.com/errata/RHSA-2019:3044
- https://access.redhat.com/errata/RHSA-2019:3045
- https://access.redhat.com/errata/RHSA-2019:3046
- https://access.redhat.com/errata/RHSA-2019:3050
- https://access.redhat.com/errata/RHSA-2020:0727
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10184
- https://github.com/undertow-io/undertow/pull/794
- https://security.netapp.com/advisory/ntap-20220210-0016/
- https://github.com/advisories/GHSA-w69w-jvc7-wjgv
- https://nvd.nist.gov/vuln/detail/CVE-2019-10184
- https://github.com/undertow-io/undertow/commit/5fa7ac68c0e4251c93056d9982db5e794e04ebfa
- https://issues.redhat.com/browse/UNDERTOW-1578