GHSA-2w73-fqqj-c92p
Improper Input Validation in Undertow
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | io.undertow:undertow-core | < 2.1.0 | 2.1.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.
References
External links from the advisory. They lead to third-party sites.