What’s Vulnerable › Vulnerabilities

CVE-2019-10184

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-07-25 · updated 2026-06-17
• Weakness: CWE-862

Description

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Affected products

• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• RedHat Jboss Data Grid: all versions
• Red Hat JBoss EAP: 7.0.0, 7.2, 7.3, 7.4
• RedHat Openshift Application Runtimes: 1.0
• Red Hat Single Sign-On: 7.0, 7.3
• Red Hat undertow: before 2.0.23 — fixed in 2.0.23

How to fix

Upgrade to a fixed version: Red Hat undertow 2.0.23. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2019:2935
• https://access.redhat.com/errata/RHSA-2019:2936
• https://access.redhat.com/errata/RHSA-2019:2937
• https://access.redhat.com/errata/RHSA-2019:2938
• https://access.redhat.com/errata/RHSA-2019:2998
• https://access.redhat.com/errata/RHSA-2019:3044
• https://access.redhat.com/errata/RHSA-2019:3045
• https://access.redhat.com/errata/RHSA-2019:3046
• https://access.redhat.com/errata/RHSA-2019:3050
• https://access.redhat.com/errata/RHSA-2020:0727
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10184
• https://github.com/undertow-io/undertow/pull/794

Get alerted when CVE-2019-10184 or the next vulnerability affects your stack