VYPR
← All advisories
High severity8.1NVD Advisory· Published Apr 21, 2020· Updated Jun 17, 2026

CVE-2020-1757

CVE-2020-1757

Description

A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
io.undertow:undertow-coreMaven
< 2.1.02.1.0

Affected products

14
  • Red Hat/DataGrid
    cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*
  • Red Hat/Jboss Enterprise Application Platform
    cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*
  • Red Hat/Jboss Fuse2 versions
    cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*
  • Red Hat/Openshift Application Runtimes
    cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*
  • Red Hat/Single Sign On
    cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*
  • Red Hat/Undertow7 versions
    cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*+ 6 more
    • cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*range: <2.1.0
    • cpe:2.3:a:redhat:undertow:2.0.0:sp1:*:*:*:*:*:*
    • cpe:2.3:a:redhat:undertow:2.0.25:sp1:*:*:*:*:*:*
    • cpe:2.3:a:redhat:undertow:2.0.26:sp3:*:*:*:*:*:*
    • cpe:2.3:a:redhat:undertow:2.0.28:sp1:*:*:*:*:*:*
    • cpe:2.3:a:redhat:undertow:2.0.28:sp2:*:*:*:*:*:*
    • (no CPE)range: all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1
  • ghsa-coords
    pkg:maven/io.undertow/undertow-core
    Range: < 2.1.0

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.