Log in Start free

Vulnerability · Published Apr 21, 2020 · Assigned by redhat

CVE-2020-1757

High 8.1

In plain English

A high-severity improper input validation in undertow from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)8.1High
Exploit odds (30 days)1.6%top 23.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14undertow2.1.0-1DEBIAN-CVE-2020-1757
Mavenio.undertow:undertow-core2.1.0GHSA-2w73-fqqj-c92p
Ubuntu:25.10undertowno fix listedUBUNTU-CVE-2020-1757
Ubuntu:26.04:LTSundertowno fix listedUBUNTU-CVE-2020-1757
Ubuntu:26.10undertowno fix listedUBUNTU-CVE-2020-1757

Affected products (as reported)

VendorProductVersions
Red Hat undertow all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final

Weakness: CWE-20, CWE-200 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References