Lucene search

RedhatCVE-2019-10184

HistoryJul 25, 2019 - 9:15 p.m.

CVE-2019-10184

2019-07-2521:15:11

CWE-862

redhat

web.nvd.nist.gov

274

undertow

cve-2019-10184

info leak

directory structure

prediction

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.2

Confidence

High

EPSS

0.005

Percentile

77.4%

JSON

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Affected configurations

Nvd

Vulners

Node

redhatundertowRange<2.0.23

Node

redhatjboss_data_gridMatch-text-only

redhatjboss_enterprise_application_platformMatch-text-only

redhatjboss_enterprise_application_platformMatch7.0.0

redhatopenshift_application_runtimesMatch-text-only

redhatopenshift_application_runtimesMatch1.0

redhatsingle_sign-onMatch-text-only

redhatsingle_sign-onMatch7.0

Node

redhatenterprise_linuxMatch8.0

AND

redhatjboss_enterprise_application_platformMatch7.2

redhatjboss_enterprise_application_platformMatch7.3

redhatjboss_enterprise_application_platformMatch7.4

Node

redhatenterprise_linuxMatch7.0

AND

redhatjboss_enterprise_application_platformMatch7.2

redhatjboss_enterprise_application_platformMatch7.3

redhatjboss_enterprise_application_platformMatch7.4

Node

redhatenterprise_linuxMatch6.0

AND

redhatjboss_enterprise_application_platformMatch7.2

redhatjboss_enterprise_application_platformMatch7.3

Node

redhatenterprise_linuxMatch8.0

AND

redhatsingle_sign-onMatch7.3

Node

redhatenterprise_linuxMatch7.0

AND

redhatsingle_sign-onMatch7.3

Node

redhatenterprise_linuxMatch6.0

AND

redhatsingle_sign-onMatch7.3

Node

netappactive_iq_unified_managerMatch-linux

netappactive_iq_unified_managerMatch-vmware_vsphere

netappactive_iq_unified_managerMatch-windows

VendorProductVersionCPE
redhatundertow*cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*
redhatjboss_data_grid-cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:*
redhatjboss_enterprise_application_platform-cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*
redhatjboss_enterprise_application_platform7.0.0cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*
redhatopenshift_application_runtimes-cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:*
redhatopenshift_application_runtimes1.0cpe:2.3:a:redhat:openshift_application_runtimes:1.0:*:*:*:*:*:*:*
redhatsingle_sign-on-cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*
redhatsingle_sign-on7.0cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*
redhatenterprise_linux8.0cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
redhatjboss_enterprise_application_platform7.2cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	undertow	*	cpe:2.3:a:redhat:undertow::::::::
redhat	jboss_data_grid	-	cpe:2.3:a:redhat:jboss_data_grid:-::::text-only:::
redhat	jboss_enterprise_application_platform	-	cpe:2.3:a:redhat:jboss_enterprise_application_platform:-::::text-only:::
redhat	jboss_enterprise_application_platform	7.0.0	cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:::::::*
redhat	openshift_application_runtimes	-	cpe:2.3:a:redhat:openshift_application_runtimes:-::::text-only:::
redhat	openshift_application_runtimes	1.0	cpe:2.3:a:redhat:openshift_application_runtimes:1.0:::::::*
redhat	single_sign-on	-	cpe:2.3:a:redhat:single_sign-on:-::::text-only:::
redhat	single_sign-on	7.0	cpe:2.3:a:redhat:single_sign-on:7.0:::::::*
redhat	enterprise_linux	8.0	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
redhat	jboss_enterprise_application_platform	7.2	cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:::::::*

Rows per page:

1-10 of 181

CNA Affected

[
  {
    "product": "undertow",
    "vendor": "undertow-io",
    "versions": [
      {
        "status": "affected",
        "version": "fixed in 2.0.23.Final"
      }
    ]
  }
]