Undertow Missing Authorization when requesting a protected directory without trailing slash

HIGH 7.5CVE-2019-10184 · GHSA-w69w-jvc7-wjgv · Published 25/07/2019 · updated 17/06/2026

In short

CVE-2019-10184 is a HIGH (CVSS 7.5) vulnerability affecting io.undertow:undertow-servlet, jboss enterprise application platform (redhat), openshift application runtimes (redhat).
Chance of exploitation in the next 30 days (EPSS): 3.5%, higher than 89.1% of all vulnerabilities.
Fix: update to 2.0.23 or later.

Package	Affected versions	Patched versions
io.undertow:undertow-servlet Maven	`< 2.0.23`	`2.0.23`
jboss enterprise application platform redhat	`= 7.0.0= 7.2= 7.3= 7.4`	No fix yet
openshift application runtimes redhat	`= 1.0`	No fix yet
single sign-on redhat	`= 7.0= 7.3`	No fix yet
undertow redhat	`< 2.0.23`	`2.0.23`

Description

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

NVD description

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

References

nvd.nist.gov/vuln/detail/CVE-2019-10184 · ADVISORY
undertow-io/undertow#794 · WEB
undertow-io/undertow commit 5fa7ac6 · WEB
access.redhat.com/errata/RHSA-2019:2935 · WEB
access.redhat.com/errata/RHSA-2019:2936 · WEB
access.redhat.com/errata/RHSA-2019:2937 · WEB
access.redhat.com/errata/RHSA-2019:2938 · WEB
access.redhat.com/errata/RHSA-2019:2998 · WEB
access.redhat.com/errata/RHSA-2019:3044 · WEB
access.redhat.com/errata/RHSA-2019:3045 · WEB
access.redhat.com/errata/RHSA-2019:3046 · WEB
access.redhat.com/errata/RHSA-2019:3050 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free