CVE-2019-10184

Опубликовано: 25 июл. 2019

Источник: nvd

CVSS3: 5.3

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Ссылки

https://access.redhat.com/errata/RHSA-2019:2935
Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:2936
Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:2937
Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:2938
Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:2998
Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:3044
Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:3045
Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:3046
Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:3050
Vendor Advisory
https://access.redhat.com/errata/RHSA-2020:0727
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10184
Issue Tracking
Vendor Advisory
https://github.com/undertow-io/undertow/pull/794
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220210-0016/
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2935
Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:2936
Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:2937
Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:2938
Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:2998
Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:3044
Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:3045
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*

Версия до 2.0.23 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:*

cpe:2.3:a:redhat:openshift_application_runtimes:1.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*

cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

Одно из

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

Одно из

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

Одно из

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

Конфигурация 6

Одновременно

cpe:2.3:a:redhat:single_sign-on:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Конфигурация 7

Одновременно

cpe:2.3:a:redhat:single_sign-on:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Конфигурация 8

Одновременно

cpe:2.3:a:redhat:single_sign-on:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

Конфигурация 9

Одно из

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*

EPSS

Процентиль: 88%

0.03478

Низкий

5.3 Medium

CVSS3

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-862

Связанные уязвимости

CVE-2019-10184

CVSS3: 7.5

ubuntu

около 7 лет назад

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

CVE-2019-10184

CVSS3: 5.3

redhat

около 7 лет назад

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

CVE-2019-10184

CVSS3: 7.5

debian

около 7 лет назад

undertow before version 2.0.23.Final is vulnerable to an information l ...

GHSA-w69w-jvc7-wjgv

CVSS3: 7.5

github

около 7 лет назад

Undertow Missing Authorization when requesting a protected directory without trailing slash

EPSS

Процентиль: 88%

0.03478

Низкий

5.3 Medium

CVSS3

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-862