GHSA-jwgx-9mmh-684wCriticalCVSS 9.8

Credential exposure through log files in Undertow

Published
June 13, 2019
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2019-3888 →

📋 Description

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)

🎯 Affected products1

  • maven/io.undertow:undertow-core:< 2.0.21

🔗 References (8)