CVE-2020-1757

State: Published
Severity: 8.1 High
Published: Apr 21, 2020
Updated: Aug 4, 2024
Reserved: Nov 27, 2019

Description

A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.

Scores

CVSS	Score	Vector	Source
3.0	8.1 High	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N	redhat

Weaknesses

Affected Products

Product	Versions
undertowRed Hat	all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1Affected all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.FinalAffected

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1757

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.