CVE-2017-7559

CWE-444 — HTTP Request Smuggling8 documents7 sources
Severity
6.1MEDIUM
EPSS
1.1%
top 21.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Redhat UndertowRED Hat, Inc. Undertow
Timeline
PublishedJan 10
Latest updateMay 13

Description

In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in the query string and path parameters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS atta…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages4 packages

▶NVDredhat/undertow1.3.0 — 1.3.31+2
▶Mavenio.undertow:undertow-core1.4.0 — 1.4.17.Final+2
▶Debianundertow< 1.4.23-1
▶CVEListV5red_hat,_inc./undertow1.3.x before 1.3.31.Final, 1.4.x before 1.4.17.Final, 2.x before 2.0.0.Alpha2+2

🔴Vulnerability Details

4
GHSA
Undertow vulnerable to Request Smuggling↗2022-05-13
▶
OSV
Undertow vulnerable to Request Smuggling↗2022-05-13
▶
CVEList
CVE-2017-7559: In Undertow 2↗2018-01-10
▶
OSV
CVE-2017-7559: In Undertow 2↗2018-01-10
▶

📋Vendor Advisories

2
Red Hat
undertow: HTTP Request smuggling vulnerability (incomplete fix of CVE-2017-2666)↗2017-12-13
▶
Debian
CVE-2017-7559: undertow - In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before...↗2017
▶

💬Community

1
Bugzilla
CVE-2017-7559 undertow: HTTP Request smuggling vulnerability (incomplete fix of CVE-2017-2666)↗2017-08-15
▶
CVE-2017-7559 (MEDIUM CVSS 6.1) | In Undertow 2.x before 2.0.0.Alpha2 | cvebase.io