Missing authorization in undertow-io undertow
Priority LOW 39CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 11 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-862.
Summary
undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.
Why it matters now
EPSS 0.03478 89th percentileScored 2026-11-07
Fix Partial io.undertow:undertow-servlet (Maven): 2.0.23Red Hat: 11 advisoriesRed Hat: 11 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| undertow-io | undertow | fixed in 2.0.23.Final | — | No fix listed | CNA |
| — | io.undertow:undertow-servlet (Maven) | before 2.0.23 | 2.0.23 | Patch available | GHSA-w69w-jvc7-wjgv |
- undertow Vendorundertow-io Affected fixed in 2.0.23.Final Fixed in — No fix listed CNA
- io.undertow:undertow-servlet (Maven) Vendor— Affected before 2.0.23 Fixed in 2.0.23 Patch available GHSA-w69w-jvc7-wjgv
CPE configurations NVD · 18
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* | before 2.0.23 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* | 7.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_application_runtimes:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:* | 7.2 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:* | 7.3 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* Versions before 2.0.23 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_application_runtimes:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
Show 8 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* | 7.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 6.0 | Running on | Red Hat |
| cpe:2.3:a:redhat:single_sign-on:7.3:*:*:*:*:*:*:* | 7.3 | Vulnerable | Red Hat |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
- cpe:2.3:a:redhat:single_sign-on:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · GHSA-w69w-jvc7-wjgv io.undertow:undertow-servlet (Maven) Fixed in 2.0.23 Advisory →
Red Hat 11 advisories
- RHSA-2020:0983 Released 2020-03-26 · Red Hat rating ImportantRed Hat Fuse 7.6.0 security update
- Red Hat Fuse 7.6.0
- RHSA-2020:0727 Released 2020-03-05 · Red Hat rating ImportantRed Hat Data Grid 7.3.3 security update
- Red Hat Data Grid 7.3.3
- RHSA-2019:3046 Released 2019-10-14 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.4 security update on RHEL 8
- Red Hat Single Sign-On 7.3 for RHEL 8 rh-sso7-keycloak-4.8.13-1.Final_redhat_00001.1.el8sso, rh-sso7-keycloak-server-4.8.13-1.Final_redhat_00001.1.el8sso
Show 8 more Red Hat advisories
- RHSA-2019:3050 Released 2019-10-14 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.4 security update
- Red Hat Single Sign-On 7.3.4 zip
- RHSA-2019:3045 Released 2019-10-14 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.4 security update on RHEL 7
- Red Hat Single Sign-On 7.3 for RHEL 7 Server rh-sso7-keycloak-4.8.13-1.Final_redhat_00001.1.el7sso, rh-sso7-keycloak-server-4.8.13-1.Final_redhat_00001.1.el7sso, rh-sso7-libunix-dbus-java-0.8.0-2.el7sso +1
- RHSA-2019:3044 Released 2019-10-14 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.4 security update on RHEL 6
- Red Hat Single Sign-On 7.3 for RHEL 6 Server rh-sso7-keycloak-4.8.13-1.Final_redhat_00001.1.el6sso, rh-sso7-keycloak-server-4.8.13-1.Final_redhat_00001.1.el6sso
- RHSA-2019:2998 Released 2019-10-10 · Red Hat rating ImportantRed Hat OpenShift Application Runtimes Thorntail 2.5.0 security & bug fix update
- Text-Only RHOAR
- RHSA-2019:2936 Released 2019-10-01 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 7 security update
- Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-activemq-artemis-2.9.0-1.redhat_00005.1.el7eap, eap7-activemq-artemis-cli-2.9.0-1.redhat_00005.1.el7eap, eap7-activemq-artemis-commons-2.9.0-1.redhat_00005.1.el7eap +47
- RHSA-2019:2937 Released 2019-10-01 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 8 security update
- Red Hat JBoss EAP 7.2 for RHEL 8 eap7-activemq-artemis-2.9.0-1.redhat_00005.1.el8eap, eap7-activemq-artemis-cli-2.9.0-1.redhat_00005.1.el8eap, eap7-activemq-artemis-commons-2.9.0-1.redhat_00005.1.el8eap +47
- RHSA-2019:2935 Released 2019-10-01 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 6 Security update
- Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-activemq-artemis-2.9.0-1.redhat_00005.1.el6eap, eap7-activemq-artemis-cli-2.9.0-1.redhat_00005.1.el6eap, eap7-activemq-artemis-commons-2.9.0-1.redhat_00005.1.el6eap +47
- RHSA-2019:2938 Released 2019-09-30 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.4 security update
- Red Hat JBoss EAP 7.2
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat Data Grid 7.3.3 | Fixed | RHSA-2020:0727 |
| Red Hat Fuse 7.6.0 | Fixed | RHSA-2020:0983 |
| Red Hat JBoss EAP 7.2 | Fixed | RHSA-2019:2938 |
| Red Hat JBoss EAP 7.2 for RHEL 6 Server | Fixed | RHSA-2019:2935 |
| Red Hat JBoss EAP 7.2 for RHEL 7 Server | Fixed | RHSA-2019:2936 |
| Red Hat JBoss EAP 7.2 for RHEL 8 | Fixed | RHSA-2019:2937 |
| Red Hat Single Sign-On 7.3 for RHEL 6 Server | Fixed | RHSA-2019:3044 |
| Red Hat Single Sign-On 7.3 for RHEL 7 Server | Fixed | RHSA-2019:3045 |
| Red Hat Single Sign-On 7.3 for RHEL 8 | Fixed | RHSA-2019:3046 |
| Red Hat Single Sign-On 7.3.4 zip | Fixed | RHSA-2019:3050 |
| Text-Only RHOAR | Fixed | RHSA-2019:2998 |
Not affected: 2 products
- Red Hat Process Automation 7
- Red Hat support for Spring Boot
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10184
- 2026-10-03 Alias added: GHSA-w69w-jvc7-wjgv
References
Advisory 13
- RHSA-2019:2937
- RHSA-2019:2935
- RHSA-2019:2936
- RHSA-2019:2938
- RHSA-2019:2998
- RHSA-2019:3044
- RHSA-2019:3045
- RHSA-2019:3050
- RHSA-2019:3046
- RHSA-2020:0727
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10184
- https://security.netapp.com/advisory/ntap-20220210-0016/
- https://nvd.nist.gov/vuln/detail/CVE-2019-10184
Sources
- CVE-2019-10184 · CVE Program
- CVE-2019-10184 · NVD
- FIRST EPSS
- GHSA-w69w-jvc7-wjgv · GitHub Advisory Database · CC BY 4.0
- CVE-2019-10184 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences