Vulnerability Description
A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Undertow | < 2.2.0 |
| Redhat | Jboss Enterprise Application Platform | - |
| Redhat | Single Sign-On | - |
| Redhat | Enterprise Linux | 6.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1785049Issue TrackingVendor Advisory
- https://lists.apache.org/thread.html/r6603513ea8afbf6857fd77ca5888ec8385d0af493b
- https://security.netapp.com/advisory/ntap-20220210-0015/Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1785049Issue TrackingVendor Advisory
- https://lists.apache.org/thread.html/r6603513ea8afbf6857fd77ca5888ec8385d0af493b
- https://security.netapp.com/advisory/ntap-20220210-0015/Third Party Advisory
FAQ
What is CVE-2020-10687?
CVE-2020-10687 is a vulnerability with a CVSS score of 4.8 (MEDIUM). A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid c...
How severe is CVE-2020-10687?
CVE-2020-10687 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-10687?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Undertow, Redhat Jboss Enterprise Application Platform, Redhat Single Sign-On, Redhat Enterprise Linux.