CVE-2020-1757
21.04.2020, 17:15
A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.Enginsight
| Vendor | Product | Version |
|---|---|---|
| redhat | undertow | 𝑥 < 2.1.0 |
| redhat | undertow | 2.0.0:sp1 |
| redhat | undertow | 2.0.25:sp1 |
| redhat | undertow | 2.0.26:sp3 |
| redhat | undertow | 2.0.28:sp1 |
| redhat | undertow | 2.0.28:sp2 |
| redhat | jboss_data_grid | 7.0.0 |
| redhat | jboss_enterprise_application_platform | 7.0.0 |
| redhat | jboss_fuse | 6.0.0 |
| redhat | jboss_fuse | 7.0.0 |
| redhat | openshift_application_runtimes | - |
| redhat | single_sign-on | 7.0 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration