CVE-2019-10184: Missing Authorization in undertow
Summary
CVE-2019-10184: Undertow Missing Authorization when requesting a protected directory without trailing slash. Affects io.undertow:undertow-servlet versions < 2.0.23. Fixed in 2.0.23. How to fix ↓
Also tracked for
- undertow · Debian:13
The same CVE-2019-10184 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is io.undertow:undertow-core, which is a part of the Maven ecosystem. Undertow is a lightweight web server designed for both embedded and standalone usage. It provides a high-performance non-blocking API for building web applications. However, versions prior to 2.0.23.Final are vulnerable to an information leak issue.
Vulnerability Detail
The vulnerability in undertow allows for an information leak, where web apps may have their directory structures predicted through requests without trailing slashes via the API. This can potentially expose sensitive information about the application's directory structure to unauthorized users. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 2.3.27.Final as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.23
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the io.undertow:undertow-core package prior to version 2.0.23.Final is vulnerable to an information leak issue. It is crucial to upgrade to the latest version to mitigate the risk of exposing sensitive information. For more information and assistance, please contact DevNack.com.
See every vulnerability recorded for io.undertow:undertow-servlet →
FAQ
The vulnerability allows unauthorized users to predict the directory structure of web apps, potentially exposing sensitive information.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file and Vulert will analyze it in real-time.
There are no known exploits available at the moment.
You can find more details about this vulnerability in the official GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/08/GHSA-w69w-jvc7-wjgv/GHSA-w69w-jvc7-wjgv.json).
For further support on vulnerability remediation, you can reach out to info@devnack.com.
References
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.