CVE-2019-10212: A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security

Critical severity · published Oct 2, 2019

CVE-2019-10212

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security

9.8

CVSS

1.9%

EPSS

On KEV

Description

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.9% · higher than 80% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Active IQ Unified Manager · Netapp

All versions, or not specified · source: NVD

Jboss Data Grid · Redhat

7.0.0 through 7.3 · source: NVD

Jboss Enterprise Application Platform · Redhat

7.2; 7.3; 7.4; 7.2; 7.3; 7.4; +2 more · source: NVD

Jboss Fuse · Redhat

7.0.0 through 7.4 · source: NVD

Openshift Application Runtimes · Redhat

All versions, or not specified · source: NVD

Single Sign-on · Redhat

7.0 through 7.3 · source: NVD

Undertow · Redhat

before 2.0.20 · source: NVD

Affected product

Active IQ Unified Manager

Netapp

All Active IQ Unified Manager CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-10212

CVE.org

https://www.cve.org/CVERecord?id=CVE-2019-10212

Vendor Advisory

https://access.redhat.com/errata/RHSA-2019:2998

Vendor Advisory

https://access.redhat.com/errata/RHSA-2020:0727

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10212

Third Party Advisory

https://security.netapp.com/advisory/ntap-20220210-0017/