CVE-2020-1745: redhat undertow Improper Authorization
Vulnerability summary
CVE-2020-1745 is a critical (CVSS 9.8) Improper Authorization vulnerability in redhat undertow. EPSS estimates a 4.96% chance of exploitation in the next 30 days, higher than 92.1% of scored vulnerabilities.
Severe, CVSS 8.6 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 5% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 8Timeline
- 28-04-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.
CVSS metrics
7 scores · 6 sources · 3 versions- CVE.orgCNA8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:LDiffers
- OSV · Red hatEcosystem advisory · calculated7.6HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
4.96%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.96% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat2 products
- undertow≤ 2.0.29
- eap7-undertow< 0:2.0.28-4.SP1_redhat_00002.1.el6eap | < 0:2.0.28-4.SP1_redhat_00002.1.el7eap | < 0:2.0.28-4.SP1_redhat_00002.1.el8eap
Debian1 product
- undertow< 2.0.30-1
Io.undertow1 product
- undertow-core< 2.0.30
Ubuntu1 product
- undertowAll versions (No fix recorded)
Undertow-io1 product
- undertow≤ 2.0.29.Final
5 vendors · 6 products
