CVE-2019-10184
undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.
- Update to 2.0.23-1
Published Updated
PatchFirst · Latest vulnerabilities
undertow vulnerabilities
Vulnerabilities published for undertow in the last 30 days: 0. Listed in the KEV catalogue: 0.
Vulnerabilities: 4
CVE-2019-3888
A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)
- Update to 2.0.23-1
Published UpdatedCVE-2018-14642
An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the code that handles flushing the buffer will always write out the full contents of the writevBuffer buffer, which may contain data from previous requests.
- Update to 2.0.23-1
Published UpdatedCVE-2017-12165
It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.
- Update to 2.0.23-1
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.