GHSA-W69W-JVC7-WJGV高危已审查

Undertow Missing Authorization when requesting a protected directory without trailing slash

OSV 1.4.0 · github-reviewed · 修改于 2023-09-25 18:52

发布时间

2019-08-02 03:18

GitHub 审查时间

2019-08-01 23:23

NVD 发布时间

2019-07-26 05:15

源文件

advisories/github-reviewed/2019/08/GHSA-w69w-jvc7-wjgv/GHSA-w69w-jvc7-wjgv.json

公告说明

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

受影响的软件包

Maven

io.undertow:undertow-servlet

ECOSYSTEM

引入0修复2.0.23

标识信息

别名 / CVE

CVE-2019-10184

CWE

CWE-862

软件生态

Maven

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-w69w-jvc7-wjgv",
  "aliases": [
    "CVE-2019-10184"
  ],
  "details": "undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.",
  "summary": "Undertow Missing Authorization when requesting a protected directory without trailing slash",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.23"
            }
          ]
        }
      ],
      "package": {
        "name": "io.undertow:undertow-servlet",
        "ecosystem": "Maven"
      }
    }
  ],
  "modified": "2023-09-25T10:52:27Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
  "published": "2019-08-01T19:18:16Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10184",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/undertow-io/undertow/pull/794",
      "type": "WEB"
    },
    {
      "url": "https://github.com/undertow-io/undertow/commit/5fa7ac68c0e4251c93056d9982db5e794e04ebfa",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2019:2935",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2019:2936",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2019:2937",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2019:2938",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2019:2998",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2019:3044",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2019:3045",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2019:3046",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2019:3050",
      "type": "WEB"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2020:0727",
      "type": "WEB"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10184",
      "type": "WEB"
    },
    {
      "url": "https://issues.redhat.com/browse/UNDERTOW-1578",
      "type": "WEB"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20220210-0016",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2019-07-25T21:15:00Z",
    "github_reviewed_at": "2019-08-01T15:23:26Z"
  }
}