CVE-2019-10184

HIGH7.5EPSS 1.5%

Undertow Missing Authorization when requesting a protected directory without trailing slash

Published: 8/1/2019Modified: 4/28/2026

Description

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Affected packages (2)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1HIGH7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References (17)