Skip to main content

Improper Authorization in io.undertow:undertow-core

CVE-2020-1745

  • io.undertow:undertow-core
High
9.8/10

Summary

A File Inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow versions through 2.0.29.Final and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-285 - Improper Authorization

The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References

Advisory Timeline

  • Published