CVEvulnerability
CVE-2019-10184
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-07-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 3.0 ([email protected])
- 5.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-862
Description
undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.
Affected configurations
• redhat undertow (< 2.0.23)
• redhat jboss data grid
• redhat jboss enterprise application platform
• redhat jboss enterprise application platform 7.0.0
• redhat openshift application runtimes
• redhat openshift application runtimes 1.0
• redhat single sign-on
• redhat single sign-on 7.0
• redhat jboss enterprise application platform 7.2
• redhat jboss enterprise application platform 7.3
• redhat jboss enterprise application platform 7.4
• redhat single sign-on 7.3
• netapp active iq unified manager
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://access.redhat.com/errata/RHSA-2019:2935 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:2936 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:2937 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:2938 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:2998 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:3044 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:3045 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:3046 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:3050 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2020:0727 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10184 Issue Tracking, Vendor Advisory
- https://github.com/undertow-io/undertow/pull/794 Patch, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220210-0016/ Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2935 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:2936 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:2937 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:2938 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:2998 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:3044 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:3045 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:3046 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:3050 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2020:0727 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10184 Issue Tracking, Vendor Advisory
- https://github.com/undertow-io/undertow/pull/794 Patch, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220210-0016/ Third Party Advisory