GitHub Advisoryadvisory · Maven

GHSA-w69w-jvc7-wjgv Undertow Missing Authorization when requesting a protected directory without trailing slash

HIGH Published 2019-08-01 Modified 2023-09-25 Official page ↗
Aliases
CVE-2019-10184
Ecosystem
Maven
Packages
io.undertow:undertow-servlet
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-862
Reviewed
2019-08-01

Affected packages

• Maven io.undertow:undertow-servlet: < 2.0.23 → fixed in 2.0.23

Description

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Related

Alias · CVE (1)

  • CVE-2019-10184 undertow before version 2.0.23.Final is vulnerable to an information leak issue. vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References