CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NCVE-2020-1757
High (8.1) in redhat. EPSS 1.6% chance of exploitation in the next 30 days. Fixed in io.undertow:undertow-core 2.1.0.
A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.
Severity
- EPSS
- 1.6% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-20, CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:jboss_data_grid
- redhat:jboss_enterprise_application_platform
- redhat:jboss_fuse
- redhat:openshift_application_runtimes
- redhat:single_sign-on
- redhat:undertow
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2w73-fqqj-c92p | Maven | io.undertow:undertow-core | <2.1.0 | 2.1.0 |