Undertow Security Vulnerabilities and Issues — Undertow CVE List

Lucene search

RedhatUndertow

3 matches found

CVE•added 2019/06/12 2:29 p.m.•321 views

CVE-2019-3888

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)

9.8CVSS9.1AI score0.00569EPSS

CVE•added 2020/04/28 3:15 p.m.•267 views

CVE-2020-1745

A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vul...

9.8CVSS9.6AI score0.02399EPSS

CVE•added 2019/10/02 7:15 p.m.•191 views

CVE-2019-10212

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.

9.8CVSS9AI score0.0029EPSS