Read the docs
TI-2020-01700 Aliases CVE-2020-1757GHSA-2w73-fqqj-c92p

Improper input validation in Red Hat undertow

Priority LOW 38CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 13 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.

Why it matters now

EPSS 0.01615 76th percentileScored 2026-11-07
Fix Partial io.undertow:undertow-core (Maven): 2.1.0Red Hat: 13 advisoriesRed Hat: 13 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatundertowall undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1; all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final—No fix listedCNA
—io.undertow:undertow-core (Maven)before 2.1.02.1.0Patch availableGHSA-2w73-fqqj-c92p
  • undertow VendorRed Hat Affected all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1; all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final Fixed in — No fix listed CNA
  • io.undertow:undertow-core (Maven) Vendor— Affected before 2.1.0 Fixed in 2.1.0 Patch available GHSA-2w73-fqqj-c92p

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*before 2.1.0VulnerableRed Hat
cpe:2.3:a:redhat:undertow:2.0.0:sp1:*:*:*:*:*:*2.0.0 sp1VulnerableRed Hat
cpe:2.3:a:redhat:undertow:2.0.25:sp1:*:*:*:*:*:*2.0.25 sp1VulnerableRed Hat
cpe:2.3:a:redhat:undertow:2.0.26:sp3:*:*:*:*:*:*2.0.26 sp3VulnerableRed Hat
cpe:2.3:a:redhat:undertow:2.0.28:sp1:*:*:*:*:*:*2.0.28 sp1VulnerableRed Hat
cpe:2.3:a:redhat:undertow:2.0.28:sp2:*:*:*:*:*:*2.0.28 sp2VulnerableRed Hat
cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
  • cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* Versions before 2.1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:2.0.0:sp1:*:*:*:*:*:* Versions 2.0.0 sp1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:2.0.25:sp1:*:*:*:*:*:* Versions 2.0.25 sp1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:2.0.26:sp3:*:*:*:*:*:* Versions 2.0.26 sp3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:2.0.28:sp1:*:*:*:*:*:* Versions 2.0.28 sp1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:2.0.28:sp2:*:*:*:*:*:* Versions 2.0.28 sp2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-2w73-fqqj-c92p io.undertow:undertow-core (Maven) Fixed in 2.1.0 Advisory →

Red Hat 13 advisories

  • RHSA-2024:5856 Released 2024-08-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-commons-beanutils-1.9.4-1.redhat_00002.1.ep7.el7, eap7-infinispan-8.2.11-1.SP2_redhat_00001.1.ep7.el7, eap7-infinispan-cachestore-jdbc-8.2.11-1.SP2_redhat_00001.1.ep7.el7 +12
  • RHSA-2020:3779 Released 2020-09-17 · Red Hat rating Important
    Red Hat Data Grid 7.3.7 security update
    • Red Hat Data Grid 7.3.7
  • RHSA-2020:3192 Released 2020-07-28 · Red Hat rating Important
    Red Hat Fuse 7.7.0 release and security update
    • Red Hat Fuse 7.7.0
Show 10 more Red Hat advisories
  • RHSA-2020:2905 Released 2020-07-23 · Red Hat rating Important
    Red Hat build of Thorntail 2.7.0 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2020:2511 Released 2020-06-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el6eap +47
  • RHSA-2020:2512 Released 2020-06-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el7eap +47
  • RHSA-2020:2513 Released 2020-06-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el8eap +47
  • RHSA-2020:2515 Released 2020-06-10 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss Enterprise Application Platform 7
  • RHSA-2020:2112 Released 2020-05-12 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.8 security update
    • Red Hat Single Sign On 7.3.8
  • RHSA-2020:2061 Released 2020-05-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.8 security update
    • Red Hat JBoss EAP 7.2
  • RHSA-2020:2060 Released 2020-05-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 8 security update
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el8eap +47
  • RHSA-2020:2059 Released 2020-05-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 7 security update
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el7eap +47
  • RHSA-2020:2058 Released 2020-05-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 6 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el6eap +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix yet
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat Data Grid 7.3.7Fixed RHSA-2020:3779
Red Hat Fuse 7.7.0Fixed RHSA-2020:3192
Red Hat JBoss EAP 7.2Fixed RHSA-2020:2061
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2020:2058
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2020:2059
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2020:2060
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2020:2513
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2020:2511
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2020:2512
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2020:2515
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2024:5856
Red Hat Single Sign On 7.3.8Fixed RHSA-2020:2112
Text-Only RHOARFixed RHSA-2020:2905
Not affected: 2 products
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-1757
  2. 2026-10-03 Alias added: GHSA-2w73-fqqj-c92p
  3. 2026-11-05 Fix available: Red Hat JBoss Enterprise Application Platform 7 · Red Hat

References

Advisory 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2021-02983 Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 CVSS 3.1HIGH 7.5
  • TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2022-01156 Improper input validation in gzip, xz-utils CVSS 3.1HIGH 8.8
  • TI-2019-02898 Sensitive information in log files in Red Hat undertow CVSS 3.1CRITICAL 9.8
  • TI-2019-07532 Sensitive information in log files in Red Hat undertow CVSS 3.1CRITICAL 9.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences