René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"CX: CVE-2020-1745 in Maven-io.undertow:undertow-core and 2.0.9.Final @ JavaVulnerableLab.refs/heads/master","articleBody":"**Description**\r\n\r\nA file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.\r\n\r\n**HIGH Vulnerable Package** issue exists @ **io.undertow:undertow-core** in branch **refs/heads/master**\r\n\r\n**Vulnerability ID:** CVE-2020-1745\r\n\r\n**Package Name:** io.undertow:undertow-core\r\n\r\n**Severity:** HIGH\r\n\r\n**CVSS Score:** 7.5\r\n\r\n**Publish Date:** 2020-04-28T15:15:00\r\n\r\n**Current Package Version:** 2.0.9.Final\r\n\r\n**Remediation Upgrade Recommendation:** 2.0.35.Final\r\n\r\n[Link To SCA](https://sca.scacheckmarx.com/#/projects/43c66723-1c23-4989-9e51-bfa32766271e/reports/e3c3068d-3289-466b-aa0f-b9c2cf00b4ea/vulnerabilities/CVE-2020-1745%3AMaven-io.undertow%3Aundertow-core-2.0.9.Final/vulnerabilityDetails/vulnerabilities/CVE-2020-1745%3AMaven-io.undertow%3Aundertow-core-2.0.9.Final/vulnerabilityDetails)\r\n\r\n[Reference – NVD link](https://nvd.nist.gov/vuln/detail/CVE-2020-1745)\r\n\r\n","author":{"url":"https://github.com/github-actions[bot]","@type":"Person","name":"github-actions[bot]"},"datePublished":"2021-08-11T16:45:38.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":21},"url":"https://github.com/33/JavaVulnerableLab/issues/33"}