GitHub Advisoryadvisory · Maven

GHSA-3jrv-jgp8-45v3 Undertow incorrectly parses cookies

HIGH Published 2024-11-17 Modified 2025-02-07 Official page ↗
Aliases
CVE-2023-4639
Ecosystem
Maven
Packages
io.undertow:undertow-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-444
Reviewed
2024-11-18

Affected packages

• Maven io.undertow:undertow-core: >= 2.3.0.Alpha1, < 2.3.11.Final → fixed in 2.3.11.Final • Maven io.undertow:undertow-core: < 2.2.30.Final → fixed in 2.2.30.Final

Description

A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

Related

Alias · CVE (1)

  • CVE-2023-4639 A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References