Configuration Bypass

2024-07-1006:28:41

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

undertow

configuration bypass

vulnerability

learning-push handler

misconfigured handler

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

Confidence

Low

EPSS

Percentile

10.8%

JSON

Undertow is vulnerable to a Configuration Bypass. The vulnerability is due to enabling the learning-push handler without configuring the maxAge setting, which defaults to -1, which allows an attacker to reach the server with a normal HTTP request and potentially exploit the misconfigured handler.