Undertow Missing Authorization when requesting a protected directory without trailing slash
undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-10184US | high7.5OT elevated | — | ||
undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes vi… | ||||
02
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2019:2935WEB
- https://access.redhat.com/errata/RHSA-2019:2936WEB
- https://access.redhat.com/errata/RHSA-2019:2937WEB
- https://access.redhat.com/errata/RHSA-2019:2938WEB
- https://access.redhat.com/errata/RHSA-2019:2998WEB
- https://access.redhat.com/errata/RHSA-2019:3044WEB
- https://access.redhat.com/errata/RHSA-2019:3045WEB
- https://access.redhat.com/errata/RHSA-2019:3046WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan