CVE-2017-12196

2018-04-1801:29:01

Google

osv.dev

0.003 Low

EPSS

Percentile

68.8%

JSON

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.

CPENameOperatorVersion
undertoweq1.2.3.Final
undertoweq1.0.0.Final
undertoweq1.3.0.Beta4
undertoweq1.1.0.Beta2
undertoweq1.0.0.Alpha18
undertoweq1.3.1.Final
undertoweq1.0.0.Beta21
undertoweq1.4.15.Final
undertoweq1.0.0.Beta9
undertoweq1.3.0.CR2

Name	Operator	Version
undertow	eq	1.2.3.Final
undertow	eq	1.0.0.Final
undertow	eq	1.3.0.Beta4
undertow	eq	1.1.0.Beta2
undertow	eq	1.0.0.Alpha18
undertow	eq	1.3.1.Final
undertow	eq	1.0.0.Beta21
undertow	eq	1.4.15.Final
undertow	eq	1.0.0.Beta9
undertow	eq	1.3.0.CR2