search

beniisan / JavaVulnLab_Cx

GNU General Public License v2.0
0 stars 0 forks source link

CX: CVE-2020-1745 in Maven-io.undertow:undertow-core and 2.0.9.Final @ JavaVulnLab_Cx.${basename #19

Open github-actions[bot] opened 3 years ago

github-actions[bot] commented 3 years ago

Description

A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.

HIGH Vulnerable Package issue exists @ io.undertow:undertow-core in branch ${basename

Vulnerability ID: CVE-2020-1745

Package Name: io.undertow:undertow-core

Severity: HIGH

CVSS Score: 7.5

Publish Date: 2020-04-28T15:15:00

Current Package Version: 2.0.9.Final

Remediation Upgrade Recommendation: 2.0.35.Final

Link To SCA

Reference – NVD link

github-actions[bot] commented 3 years ago

Issue still exists.