PT-2019-5652 · Red Hat · Undertow

Published 2019-06-10 · Updated 2022-02-20 · CVE-2019-3888

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Undertow web server versions prior to 2.0.21

Description The issue is related to insufficient protection of registration data, which can lead to the exposure of protected information. Specifically, the vulnerability allows an attacker to disclose plain text credentials through log files. This occurs because the Connectors.executeRootHandler logs the HttpServerExchange object at the ERROR level using UndertowLogger.REQUEST LOGGER.undertowRequestFailed.

Recommendations For versions prior to 2.0.21, update to version 2.0.21 or later to resolve the issue. As a temporary workaround, consider restricting access to log files to minimize the risk of exploitation.

Fix

XSS

Insertion into Log File

Weakness Enumeration

CWE-79

CWE-532

Related Identifiers

BDU:2020-04801

BDU:2020-04803

CVE-2019-3888

GHSA-JWGX-9MMH-684W

OESA-2021-1422

RHSA-2019:1419

RHSA-2019:1420

RHSA-2019:1421

RHSA-2019:2439

Affected Products

Undertow

References · 28

• https://access.redhat.com/errata/RHSA-2019:2998 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3872 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-10719 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-3888 · Security Note
• https://access.redhat.com/errata/RHSA-2020:0727 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1422 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3888 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10705 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-3888 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04803 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3888 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2439 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-3888 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-3888 · Security Note
• https://ubuntu.com/security/CVE-2019-3888 · Vendor Advisory