CVE-2017-12196 | BDVDB-2026-99668 Detail
undertow
Description#
undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.
Impact#
Per CVSS v3.0: confidentiality impact high, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-287 Improper Authentication
References#
- https://access.redhat.com/errata/RHSA-2018:0479
- https://access.redhat.com/errata/RHSA-2018:0481
- https://access.redhat.com/errata/RHSA-2018:2405
- https://access.redhat.com/errata/RHSA-2018:1525
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12196
- https://access.redhat.com/errata/RHSA-2018:0480
- https://issues.jboss.org/browse/UNDERTOW-1190
- https://access.redhat.com/errata/RHSA-2018:3768
- https://access.redhat.com/errata/RHSA-2018:0478
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.