~ / search / GHSA-w69w-jvc7-wjgv

GHSA-w69w-jvc7-wjgv

Undertow Missing Authorization when requesting a protected directory without trailing slash

Source: GitHub Advisory Database (reviewed) High CVE-2019-10184

Packages

EcosystemPackageAffectedFixed in
Maven io.undertow:undertow-servlet < 2.0.23 2.0.23

Details

As written in the advisory (Markdown source, shown as plain text).

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

References

External links from the advisory. They lead to third-party sites.