CVE-2019-10184

Undertow Missing Authorization when requesting a protected directory without trailing slash

5.3 MediumFix available

CVE-2019-10184 is a medium vulnerability (CVSS 5.3) in Red Hat Undertow, published July 25, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.48%, the 89th percentile. Fixed in io.undertow:undertow-servlet 2.0.23.

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

3.48%Up 0.6 points since Apr 14, 2021

What each source reports

CVE List Score used 5.3

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Record: CVE-2019-10184
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-02

EUVDEUVD-2019-0642 5.3

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Record: EUVD-2019-0642
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w69w-jvc7-wjgv 7.5

Undertow Missing Authorization when requesting a protected directory without trailing slash

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Record: GHSA-w69w-jvc7-wjgv
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-02

NVD 7.5

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Record: CVE-2019-10184
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-02

OSV 7.5

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Record: CVE-2019-10184
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-10184 7.5

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Record: DEBIAN-CVE-2019-10184
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Show 9 moreShow less

OSVGHSA-w69w-jvc7-wjgv 7.5

Undertow Missing Authorization when requesting a protected directory without trailing slash

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Record: GHSA-w69w-jvc7-wjgv
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-02

OSVOESA-2025-1257 9.8

undertow security update

Java web server using non-blocking IO

Security Fix(es):

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.(CVE-2017-12196)

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.(CVE-2019-10184)

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.(CVE-2019-10212)

Record: OESA-2025-1257
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2019:2935 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 6 Security update

Record: RHSA-2019:2935
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2019:2936 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 7 security update

Record: RHSA-2019:2936
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2019:2937 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 8 security update

Record: RHSA-2019:2937
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2019:3044 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.3.4 security update on RHEL 6

Record: RHSA-2019:3044
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2019:3045 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.3.4 security update on RHEL 7

Record: RHSA-2019:3045
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2019:3046 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.3.4 security update on RHEL 8

Record: RHSA-2019:3046
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-10184 7.5

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Record: UBUNTU-CVE-2019-10184
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`io.undertow:undertow-servlet` Maven	before 2.0.23	2.0.23
`undertow` Debian:14	before 2.0.23-1, plus listed versions 1.3.11-11.3.16-11.3.19-11.3.21-11.3.23-1 Show 20 moreShow less 1.3.4-11.3.5-11.3.7-11.4.0-11.4.1-11.4.18-11.4.20-11.4.21-11.4.21-21.4.22-11.4.23-11.4.23-21.4.23-31.4.25-11.4.25-21.4.3-11.4.4-11.4.6-11.4.7-11.4.8-1	2.0.23-1
`io.undertow:undertow-servlet` Maven	before 2.0.23, plus listed versions 1.0.0.Alpha11.0.0.Alpha101.0.0.Alpha111.0.0.Alpha121.0.0.Alpha13 Show 45 moreShow less 1.0.0.Alpha141.0.0.Alpha151.0.0.Alpha161.0.0.Alpha171.0.0.Alpha181.0.0.Alpha191.0.0.Alpha21.0.0.Alpha201.0.0.Alpha211.0.0.Alpha221.0.0.Alpha31.0.0.Alpha41.0.0.Alpha51.0.0.Alpha61.0.0.Alpha71.0.0.Alpha81.0.0.Alpha91.0.0.Beta11.0.0.Beta101.0.0.Beta111.0.0.Beta121.0.0.Beta131.0.0.Beta141.0.0.Beta151.0.0.Beta161.0.0.Beta171.0.0.Beta181.0.0.Beta191.0.0.Beta21.0.0.Beta201.0.0.Beta211.0.0.Beta221.0.0.Beta231.0.0.Beta241.0.0.Beta251.0.0.Beta261.0.0.Beta271.0.0.Beta281.0.0.Beta291.0.0.Beta31.0.0.Beta301.0.0.Beta311.0.0.Beta321.0.0.Beta331.0.0.Beta4	2.0.23
`undertow` openEuler:24.03-LTS-SP1	before 1.4.0-10.oe2403sp1	1.4.0-10.oe2403sp1
`undertow` openEuler:20.03-LTS-SP4	before 1.4.0-9.oe2003sp4	1.4.0-9.oe2003sp4
`undertow` openEuler:22.03-LTS-SP3	before 1.4.0-9.oe2203sp3	1.4.0-9.oe2203sp3
`undertow` openEuler:22.03-LTS-SP4	before 1.4.0-9.oe2203sp4	1.4.0-9.oe2203sp4
`undertow` openEuler:24.03-LTS	before 1.4.0-10.oe2403	1.4.0-10.oe2403
`eap7-activemq-artemis` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.9.0-1.redhat_00005.1.el6eap	0:2.9.0-1.redhat_00005.1.el6eap
`eap7-activemq-artemis-cli` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.9.0-1.redhat_00005.1.el6eap	0:2.9.0-1.redhat_00005.1.el6eap

Show 290 moreShow less

History

History
When	Changed	Sources
2026-11-03	aliases, products	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 93 moreShow less

This page doesn't list everything

Left out here: 116 package rows and 189 versions. The JSON record has them.

Affected packages
Package	Affected	Fixed
`eap7-activemq-artemis-commons` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.9.0-1.redhat_00005.1.el6eap	0:2.9.0-1.redhat_00005.1.el6eap
`eap7-activemq-artemis-core-client` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.9.0-1.redhat_00005.1.el6eap	0:2.9.0-1.redhat_00005.1.el6eap
`eap7-activemq-artemis-dto` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.9.0-1.redhat_00005.1.el6eap	0:2.9.0-1.redhat_00005.1.el6eap
`eap7-activemq-artemis-hornetq-protocol` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.9.0-1.redhat_00005.1.el6eap	0:2.9.0-1.redhat_00005.1.el6eap
`eap7-activemq-artemis-hqclient-protocol` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.9.0-1.redhat_00005.1.el6eap	0:2.9.0-1.redhat_00005.1.el6eap
`eap7-activemq-artemis-jdbc-store` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.9.0-1.redhat_00005.1.el6eap	0:2.9.0-1.redhat_00005.1.el6eap
`eap7-activemq-artemis-jms-client` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.9.0-1.redhat_00005.1.el6eap	0:2.9.0-1.redhat_00005.1.el6eap
`eap7-activemq-artemis-jms-server` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.9.0-1.redhat_00005.1.el6eap	0:2.9.0-1.redhat_00005.1.el6eap
`eap7-activemq-artemis-journal` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.9.0-1.redhat_00005.1.el6eap	0:2.9.0-1.redhat_00005.1.el6eap
`eap7-activemq-artemis-ra` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.9.0-1.redhat_00005.1.el6eap	0:2.9.0-1.redhat_00005.1.el6eap
`eap7-activemq-artemis-selector` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.9.0-1.redhat_00005.1.el6eap	0:2.9.0-1.redhat_00005.1.el6eap
`eap7-activemq-artemis-server` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.9.0-1.redhat_00005.1.el6eap	0:2.9.0-1.redhat_00005.1.el6eap
`eap7-activemq-artemis-service-extensions` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.9.0-1.redhat_00005.1.el6eap	0:2.9.0-1.redhat_00005.1.el6eap
`eap7-activemq-artemis-tools` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.9.0-1.redhat_00005.1.el6eap	0:2.9.0-1.redhat_00005.1.el6eap
`eap7-codehaus-jackson` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:1.9.13-9.redhat_00006.1.el6eap	0:1.9.13-9.redhat_00006.1.el6eap
`eap7-codehaus-jackson-core-asl` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:1.9.13-9.redhat_00006.1.el6eap	0:1.9.13-9.redhat_00006.1.el6eap
`eap7-codehaus-jackson-jaxrs` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:1.9.13-9.redhat_00006.1.el6eap	0:1.9.13-9.redhat_00006.1.el6eap
`eap7-codehaus-jackson-mapper-asl` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:1.9.13-9.redhat_00006.1.el6eap	0:1.9.13-9.redhat_00006.1.el6eap
`eap7-codehaus-jackson-xc` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:1.9.13-9.redhat_00006.1.el6eap	0:1.9.13-9.redhat_00006.1.el6eap
`eap7-glassfish-jsf` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:2.3.5-4.SP3_redhat_00002.1.el6eap	0:2.3.5-4.SP3_redhat_00002.1.el6eap
`eap7-hal-console` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:3.0.16-1.Final_redhat_00001.1.el6eap	0:3.0.16-1.Final_redhat_00001.1.el6eap
`eap7-hibernate` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:5.3.11-2.SP1_redhat_00001.1.el6eap	0:5.3.11-2.SP1_redhat_00001.1.el6eap
`eap7-hibernate-core` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:5.3.11-2.SP1_redhat_00001.1.el6eap	0:5.3.11-2.SP1_redhat_00001.1.el6eap
`eap7-hibernate-entitymanager` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:5.3.11-2.SP1_redhat_00001.1.el6eap	0:5.3.11-2.SP1_redhat_00001.1.el6eap
`eap7-hibernate-envers` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:5.3.11-2.SP1_redhat_00001.1.el6eap	0:5.3.11-2.SP1_redhat_00001.1.el6eap
`eap7-hibernate-java8` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:5.3.11-2.SP1_redhat_00001.1.el6eap	0:5.3.11-2.SP1_redhat_00001.1.el6eap
`eap7-infinispan` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:9.3.7-1.Final_redhat_00001.1.el6eap	0:9.3.7-1.Final_redhat_00001.1.el6eap
`eap7-infinispan-cachestore-jdbc` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:9.3.7-1.Final_redhat_00001.1.el6eap	0:9.3.7-1.Final_redhat_00001.1.el6eap
`eap7-infinispan-cachestore-remote` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:9.3.7-1.Final_redhat_00001.1.el6eap	0:9.3.7-1.Final_redhat_00001.1.el6eap
`eap7-infinispan-client-hotrod` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:9.3.7-1.Final_redhat_00001.1.el6eap	0:9.3.7-1.Final_redhat_00001.1.el6eap
`eap7-infinispan-commons` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:9.3.7-1.Final_redhat_00001.1.el6eap	0:9.3.7-1.Final_redhat_00001.1.el6eap
`eap7-infinispan-core` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:9.3.7-1.Final_redhat_00001.1.el6eap	0:9.3.7-1.Final_redhat_00001.1.el6eap
`eap7-infinispan-hibernate-cache-commons` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:9.3.7-1.Final_redhat_00001.1.el6eap	0:9.3.7-1.Final_redhat_00001.1.el6eap
`eap7-infinispan-hibernate-cache-spi` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:9.3.7-1.Final_redhat_00001.1.el6eap	0:9.3.7-1.Final_redhat_00001.1.el6eap
`eap7-infinispan-hibernate-cache-v53` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:9.3.7-1.Final_redhat_00001.1.el6eap	0:9.3.7-1.Final_redhat_00001.1.el6eap
`eap7-ironjacamar` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:1.4.17-1.Final_redhat_00001.1.el6eap	0:1.4.17-1.Final_redhat_00001.1.el6eap
`eap7-ironjacamar-common-api` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:1.4.17-1.Final_redhat_00001.1.el6eap	0:1.4.17-1.Final_redhat_00001.1.el6eap
`eap7-ironjacamar-common-impl` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:1.4.17-1.Final_redhat_00001.1.el6eap	0:1.4.17-1.Final_redhat_00001.1.el6eap
`eap7-ironjacamar-common-spi` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:1.4.17-1.Final_redhat_00001.1.el6eap	0:1.4.17-1.Final_redhat_00001.1.el6eap
`eap7-ironjacamar-core-api` Red Hat:jboss_enterprise_application_platform:7.2::el6	before 0:1.4.17-1.Final_redhat_00001.1.el6eap	0:1.4.17-1.Final_redhat_00001.1.el6eap