Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 43

Export CSV
CVE-2017-2666

undertow: HTTP Request smuggling vulnerability due to permitting invalid characters in HTTP requests

It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.

CVSS 3.0 · 6.5 Medium EPSS 3.1% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Enterprise Linux Jboss Enterprise Application Platform and 1 more
CVE-2017-12196

undertow: Client can use bogus uri in Digest authentication

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.

CVSS 3.0 · 4.8 Medium EPSS 2.0% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform Jboss Enterprise Application Platform Cd and 3 more
CVE-2017-12165

undertow: improper whitespace parsing leading to potential HTTP request smuggling

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.

CVSS 3.0 · 2.6 Low EPSS 1.9% KEV · Not listed
Vendors
Redhat
Products
Jboss Amq Jboss Enterprise Application Platform Jboss Fuse and 1 more