Vulnerability · Published Sep 23, 2020 · Assigned by redhat
CVE-2020-10687
Medium 4.8
In plain English
A medium-severity security flaw in Undertow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)4.8Medium
Exploit odds (30 days)1.2%top 30.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | undertow | 2.2.0-1 | DEBIAN-CVE-2020-10687 |
| Maven | io.undertow:undertow-core | 2.2.0.Final | GHSA-p9w3-gwc2-cr49 |
| Ubuntu:25.10 | undertow | no fix listed | UBUNTU-CVE-2020-10687 |
| Ubuntu:26.04:LTS | undertow | no fix listed | UBUNTU-CVE-2020-10687 |
| Ubuntu:26.10 | undertow | no fix listed | UBUNTU-CVE-2020-10687 |
Affected products (as reported)
Weakness: CWE-444
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1785049 x_refsource_MISC
- [cxf-dev] 20210129 Undertow CVE mailing-list, x_refsource_MLIST
- https://security.netapp.com/advisory/ntap-20220210-0015/ x_refsource_CONFIRM