CVE-2020-1745
Description
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.
Statement
Please refer to the Red Hat knowledgebase article: https://access.redhat.com/solutions/4851251 and CVE page https://access.redhat.com/security/cve/cve-2020-1938
Mitigation
Please refer to the Red Hat knowledgebase article: https://access.redhat.com/solutions/4851251
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.6 | 9.8 | N/A |
| Attack Vector | Adjacent Network | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | Low | High | N/A |
| Availability Impact | Low | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
Red Hat Product Security strongly recommends that AJP, as an insecure mechanism, should never be exposed to untrusted clients or run on an open, unsecured network. Also, successful exploitation of this vulnerability depends upon poor configuration of the server by allowing unrestricted file upload. In accordance with this, Red Hat has scored differently from NVD as AV:N/I:H/A:H -> AV:A/I:L/A:L, yielding a base score of 7.6. This does not affect Red Hat's original assigned impact of Important.
Acknowledgements
Red Hat would like to thank Robert Roberson, Steve Zapantis, and taktakdb4g for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
