CVE-2017-12196
unspecified undertow
MEDIUM 4.8
At a glance
- Source
- NVD
- EPSS
- EPSS 2.01 % · percentile 81 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.
Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2018:0479
- https://access.redhat.com/errata/RHSA-2018:0481
- https://access.redhat.com/errata/RHSA-2018:2405
- https://access.redhat.com/errata/RHSA-2018:1525
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12196
- https://access.redhat.com/errata/RHSA-2018:0480
- https://issues.jboss.org/browse/UNDERTOW-1190
- https://access.redhat.com/errata/RHSA-2018:3768
- https://access.redhat.com/errata/RHSA-2018:0478
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 4.8 | CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N | redhat |
| CVSS 3.0 | MEDIUM 4.8 | CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.0 | MEDIUM 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-cp7v-vmv7-6x2q — Incorrect Authorization in Undertow
European references
- ENISA EUVD · EUVD-2022-3602
- GCVE · GCVE-0-2017-12196
Affected configurations (NVD CPE)
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*≤ 1.4.18cpe:2.3:a:redhat:undertow:1.4.24:*:*:*:*:*:*:*cpe:2.3:a:redhat:undertow:2.0.2:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| unspecified · undertow | affected undertow 1.4.18.SP1 ; affected undertow 2.0.2.Final ; affected undertow 1.4.24.Final |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |