8.1
High
CVE-2020-1757 A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and…
Description
A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| undertow | Versions not published |
Other CVEs of undertow
The 7 CVEs of undertow →
CVE-2020-10719
A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with…
6.5
Medium
CVE-2019-14888
A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS
7.5
High
CVE-2019-3888
A vulnerability was found in Undertow web server before 2.0.21
5.3
Medium
CVE-2018-14642
An information leak vulnerability was found in Undertow
5.3
Medium