Veracode Vulnerability DatabaseVERACODE:22687Directory Traversal
0.01 Low
EPSS
Percentile
83.8%
undertow is vulnerable to directory traversal attacks. The vulnerability exists due to input validation error in AJP connector. A remote attacker can send a specially crafted HTTP request to port 8009/tcp and read arbitrary files on the system.
References
access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/
access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/
access.redhat.com/errata/RHSA-2020:0813
access.redhat.com/security/updates/classification/#critical
bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1745
meterpreter.org/cve-2020-1938-apache-tomcat-ajp-connector-remote-code-execution-vulnerability-alert/
www.cnvd.org.cn/webinfo/show/5415
www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487
Related
