CVE-2019-3888
published 2019-06-12CVE-2019-3888: A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because…
critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | undertow | < undertow 2.0.23-1 (forky) | undertow 2.0.23-1 (forky) |
| red_hat | undertow | — | — |
| redhat | undertow | < 2.0.21 | 2.0.21 |
| redhat | undertow | >= 0 < 2.0.23-1 | 2.0.23-1 |
| redhat | virtualization | — | — |
| redhat | virtualization_host | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL