CVE-2017-12196

moderate-risk

Published 2018-04-18

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.

Do I need to act?

0.51% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.8/10 Medium

NETWORK / HIGH complexity

Affected Products (6)

Undertow

Jboss Enterprise Application Platform

Jboss Fuse

Virtualization

Affected Vendors

Redhat

References (18)

Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0478

Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0479

Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0480

Vendor Advisory https://access.redhat.com/errata/RHSA-2018:0481

Vendor Advisory https://access.redhat.com/errata/RHSA-2018:1525

Vendor Advisory https://access.redhat.com/errata/RHSA-2018:2405

Vendor Advisory https://access.redhat.com/errata/RHSA-2018:3768

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12196

Issue Tracking https://issues.jboss.org/browse/UNDERTOW-1190