GitHub Advisoryadvisory · Maven

GHSA-2w73-fqqj-c92p Improper Input Validation in Undertow

HIGH Published 2022-05-24 Modified 2022-06-27 Official page ↗
Aliases
CVE-2020-1757
Ecosystem
Maven
Packages
io.undertow:undertow-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-20, CWE-200
Reviewed
2022-06-24

Affected packages

• Maven io.undertow:undertow-core: < 2.1.0 → fixed in 2.1.0

Description

A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.

Related

Alias · CVE (1)

  • CVE-2020-1757 A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References