PT-2020-15038 · Red Hat · Undertow

Published 2020-04-21 · Updated 2022-05-24 · CVE-2020-1757

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions undertow versions prior to 2.0.30.SP1 undertow versions prior to 2.1.0.Final

Description A flaw was found in the Servlet container where it causes servletPath to normalize incorrectly by truncating the path after a semicolon, which may lead to an application mapping resulting in a security bypass.

Recommendations For undertow versions prior to 2.0.30.SP1, update to version 2.0.30.SP1 or later. For undertow versions prior to 2.1.0.Final, update to version 2.1.0.Final or later.

Fix

RCE

Information Disclosure

Weakness Enumeration

CWE-20

CWE-200

Related Identifiers

CVE-2020-1757

GHSA-2W73-FQQJ-C92P

RHSA-2020:2058

RHSA-2020:2059

RHSA-2020:2060

RHSA-2020:2511

RHSA-2020:2512

RHSA-2020:2513

RHSA-2024:5856

Affected Products

Undertow

References · 10

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1757 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1757 · Security Note
• https://ubuntu.com/security/CVE-2020-1757 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-1757 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2w73-fqqj-c92p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1757 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-1757 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-1757 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-1757 · Vendor Advisory
• https://t.me/cvenotify/2975 · Telegram Post