CVE-2020-10719: A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes

Medium severity · published May 26, 2020

CVE-2020-10719

A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes

6.5

CVSS

EPSS

On KEV

Description

A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.0% · higher than 63% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Active IQ Unified Manager · Netapp

All versions, or not specified · source: NVD

Fuse · Redhat

1.0 · source: NVD

Jboss Enterprise Application Platform · Redhat

7.3; 7.4; 7.3; 7.4; 7.3; 7.2; +2 more · source: NVD

Oncommand Insight · Netapp

before 7.3.13 · source: NVD

Oncommand Workflow Automation · Netapp

All versions, or not specified · source: NVD

Openshift Application Runtimes · Redhat

All versions, or not specified · source: NVD

Single Sign-on · Redhat

All versions, or not specified · source: NVD

Undertow · Redhat

before 2.1.1 · source: NVD

Affected product

Active IQ Unified Manager

Netapp

All Active IQ Unified Manager CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-10719

CVE.org

https://www.cve.org/CVERecord?id=CVE-2020-10719

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10719

Third Party Advisory

https://security.netapp.com/advisory/ntap-20220210-0014/