CVE-2019-10184: undertow before version 2.0.23.Final is vulnerable to an information leak issue

High severity · published Jul 25, 2019

CVE-2019-10184

undertow before version 2.0.23.Final is vulnerable to an information leak issue

7.5

CVSS

3.5%

EPSS

On KEV

Description

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)3.5% · higher than 89% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Active IQ Unified Manager · Netapp

All versions, or not specified · source: NVD

Jboss Data Grid · Redhat

All versions, or not specified · source: NVD

Jboss Enterprise Application Platform · Redhat

7.0.0; 7.2; 7.3; 7.4; 7.2; 7.3; +3 more · source: NVD

Openshift Application Runtimes · Redhat

1.0 · source: NVD

Single Sign-on · Redhat

7.0; 7.3; 7.3; 7.3 · source: NVD

Undertow · Redhat

before 2.0.23 · source: NVD

Affected product

Active IQ Unified Manager

Netapp

All Active IQ Unified Manager CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-10184

CVE.org

https://www.cve.org/CVERecord?id=CVE-2019-10184

Vendor Advisory

https://access.redhat.com/errata/RHSA-2019:2935

Vendor Advisory

https://access.redhat.com/errata/RHSA-2019:2936

Vendor Advisory

https://access.redhat.com/errata/RHSA-2019:2937

Vendor Advisory

https://access.redhat.com/errata/RHSA-2019:2938

Vendor Advisory

https://access.redhat.com/errata/RHSA-2019:2998

Vendor Advisory

https://access.redhat.com/errata/RHSA-2019:3044