GoogleOSV:GHSA-CP7V-VMV7-6X2QIncorrect Authorization in Undertow
0.003 Low
EPSS
Percentile
68.8%
Undertow before versions 1.4.18.SP1 (not findable in Maven), 2.0.2.Final, and 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.
References
access.redhat.com/errata/RHSA-2018:0478
access.redhat.com/errata/RHSA-2018:0479
access.redhat.com/errata/RHSA-2018:0480
access.redhat.com/errata/RHSA-2018:0481
access.redhat.com/errata/RHSA-2018:1525
access.redhat.com/errata/RHSA-2018:2405
access.redhat.com/errata/RHSA-2018:3768
bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12196
github.com/undertow-io/undertow
github.com/undertow-io/undertow/commit/facb33a5cedaf4b7b96d3840a08210370a806870
issues.jboss.org/browse/UNDERTOW-1190
nvd.nist.gov/vuln/detail/CVE-2017-12196
Related
