PT-2019-5311 · Red Hat · Undertow

Marian Rehak · Publicado 2019-10-02 · Atualizado 2025-03-07 · CVE-2019-10212

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Undertow versions prior to 2.0.20

Description A flaw was found in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files. The vulnerability is related to the disclosure of information through log files and can be exploited by a remote attacker.

Recommendations For versions prior to 2.0.20, consider disabling the DEBUG log for io.undertow.request.security to prevent the disclosure of user credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

BDU:2020-02258

CVE-2019-10212

GHSA-8VH8-VC28-M2HF

OESA-2025-1257

RHSA-2019:2935

RHSA-2019:2936

RHSA-2019:2937

Produtos afetados

Undertow

Referências · 22

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10212 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10212 · Nota
• https://security.netapp.com/advisory/ntap-20220210-0017 · Nota
• https://osv.dev/vulnerability/OESA-2025-1257 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2019:2998 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12196 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2020:0727 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1731984 · Nota
• https://osv.dev/vulnerability/CVE-2019-10212 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10212 · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2019-10212 · Nota
• https://security-tracker.debian.org/tracker/CVE-2019-10212 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10212 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2019-10212 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-10184 · Nota de Segurança