1. Home
  2. CVE Database
  3. CVE-2017-12196
MEDIUM · 4.8

CVE-2017-12196

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header match...

Vulnerability Description

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.

CVSS Score

4.8

MEDIUM

CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
RedhatUndertow<= 1.4.18
RedhatJboss Enterprise Application Platform7.0.0
RedhatJboss Fuse6.0.0
RedhatVirtualization4.0

Related Weaknesses (CWE)

CWE-287CWE-863

References

FAQ

What is CVE-2017-12196?

CVE-2017-12196 is a vulnerability with a CVSS score of 4.8 (MEDIUM). undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header match...

How severe is CVE-2017-12196?

CVE-2017-12196 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-12196?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Undertow, Redhat Jboss Enterprise Application Platform, Redhat Jboss Fuse, Redhat Virtualization.