GHSA-2w73-fqqj-c92p

ghsaUSosv

Improper Input Validation in Undertow

view advisory published 2022-05-24Licence: CC-BY-4.0

A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-1757US	high8.1	1.62% (76th)	—	2020-04-21
A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet co…

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1757WEB
https://nvd.nist.gov/vuln/detail/CVE-2020-1757ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan