CVE-2017-12196
unspecified undertow
MEDIUM 4.8
En bref
- Source
- NVD
- EPSS
- EPSS 2.01 % · centile 81 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.
Faiblesses (CWE)
Références
- https://access.redhat.com/errata/RHSA-2018:0479
- https://access.redhat.com/errata/RHSA-2018:0481
- https://access.redhat.com/errata/RHSA-2018:2405
- https://access.redhat.com/errata/RHSA-2018:1525
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12196
- https://access.redhat.com/errata/RHSA-2018:0480
- https://issues.jboss.org/browse/UNDERTOW-1190
- https://access.redhat.com/errata/RHSA-2018:3768
- https://access.redhat.com/errata/RHSA-2018:0478
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 4.8 | CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N | redhat |
| CVSS 3.0 | MEDIUM 4.8 | CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.0 | MEDIUM 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-cp7v-vmv7-6x2q — Incorrect Authorization in Undertow
Références européennes
- ENISA EUVD · EUVD-2022-3602
- GCVE · GCVE-0-2017-12196
Configurations affectées (CPE NVD)
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*≤ 1.4.18cpe:2.3:a:redhat:undertow:1.4.24:*:*:*:*:*:*:*cpe:2.3:a:redhat:undertow:2.0.2:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| unspecified · undertow | affected undertow 1.4.18.SP1 ; affected undertow 2.0.2.Final ; affected undertow 1.4.24.Final |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |