Undertow Io Undertow vulnerabilities
2 vulnerabilities
Known vulnerabilities in Undertow Io Undertow, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
PrioritiseCVE-2020-1745undertow-io · undertow +5 moreundertow-io undertowA file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.CVSS9.8CriticalEPSS4.96%RoutineCVE-2019-10184undertow-io · undertow +9 moreundertow-io undertowundertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.CVSS7.5HighEPSS3.48%