Man-in-the-Middle (MitM) Affecting io.undertow:undertow-core package, versions [,1.4.18.SP1) [1.4.20.Final,1.4.24.Final) [2.0.0.Final,2.0.2.Final)
Threat Intelligence
EPSS
0.28% (70th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-IOUNDERTOW-32142
- published 1 Apr 2018
- disclosed 12 Mar 2018
- credit Jan Stourac
Introduced: 12 Mar 2018
CVE-2017-12196 Open this link in a new tabHow to fix?
Upgrade io.undertow:undertow-core to version 1.4.18.SP1, 1.4.24.Final, 2.0.2.Final or higher.
Overview
io.undertow:undertow-core is a Java web server based on non-blocking IO.
Affected versions of this package are vulnerable to Man-in-the-Middle (MitM) attacks. When using a Digest authentication, the server does not ensure that value of the URI attribute in the "Authorization" header matches URI in HTTP request line. An attacker can use this attack vector in order to access desired content on a server.
References
CVSS Scores
version 3.1