CVE-2020-1745
High
Description
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.
SeverityHigh
CVSS8.6
Exploit probability—
Product
Redhat Undertow
PublishedApr 28, 2020
First seenApr 28, 2020
Weakness typeCWE-285CWE-285
How to fix
Update
- io.undertow:undertow-core2.0.30 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat undertow | v ≤ 2.0.29 | — |
| io.undertow:undertow-coreMaven | v < 2.0.30 | 2.0.30 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.