PT-2019-11609 · Red Hat · Undertow

Gaol · Published 2019-07-25 · Updated 2025-03-07 · CVE-2019-10184

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: undertow versions prior to 2.0.23.Final

Description: The issue allows web apps to have their directory structures predicted through requests without trailing slashes via the API. This is an information leak issue.

Recommendations: For versions prior to 2.0.23.Final, update to version 2.0.23.Final or later to resolve the issue. As a temporary workaround, consider restricting access to the API to minimize the risk of exploitation. Avoid making requests without trailing slashes to affected web apps until the issue is resolved.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2019-10184

GHSA-W69W-JVC7-WJGV

OESA-2025-1257

RHSA-2019:2935

RHSA-2019:2936

RHSA-2019:2937

RHSA-2019:3044

RHSA-2019:3045

RHSA-2019:3046

Affected Products

Undertow

References · 29

• https://github.com/undertow-io/undertow/pull/794 · Patch
• https://access.redhat.com/errata/RHSA-2019:3050 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10184 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2998 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10184 · Security Note
• https://access.redhat.com/errata/RHSA-2019:2937 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-10184 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2936 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2020:0727 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3046 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3044 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2935 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10184 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1257 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10212 · Security Note