CVE-2019-10184
Published: 25 July 2019
undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
undertow Launchpad, Ubuntu, Debian |
bionic |
Needed
|
| disco |
Ignored
(end of life)
|
|
| eoan |
Released
(2.0.23-1)
|
|
| focal |
Released
(2.0.23-1)
|
|
| groovy |
Released
(2.0.23-1)
|
|
| hirsute |
Released
(2.0.23-1)
|
|
| impish |
Released
(2.0.23-1)
|
|
| jammy |
Released
(2.0.23-1)
|
|
| kinetic |
Released
(2.0.23-1)
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Needed
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |