CVE-2020-1757

undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass

Published Apr 21, 2020 CVSS 3.1 · 8.1 High EPSS 1.6% KEV · Not listed
Description
A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.

Analysis

No analysis available yet

Remediation

No remediation available yet

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-2061 A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.
Github GHSA Github GHSA GHSA-2w73-fqqj-c92p Improper Input Validation in Undertow
History
Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Eus
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7
Vendors & Products Redhat jboss Enterprise Application Platform Eus
Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 4, 2024, 6:46 AM
Reserved
Nov 27, 2019, 12:00 AM
Status
Modified
Published
Apr 21, 2020, 5:15 PM
Modified
Jun 17, 2026, 3:02 AM
Severity
Important
Public date
Dec 19, 2018, 12:00 AM