GitHub Advisoryadvisory · Maven

GHSA-8vh8-vc28-m2hf Potential to access user credentials from the log files when debug logging enabled

CRITICAL Published 2019-11-20 Modified 2022-02-11 Official page ↗
Aliases
CVE-2019-10212
Ecosystem
Maven
Packages
io.undertow:undertow-core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-532
Reviewed
2019-11-19

Affected packages

• Maven io.undertow:undertow-core: < 2.0.20 → fixed in 2.0.20

Description

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.

Related

Alias · CVE (1)

  • CVE-2019-10212 A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References