Vulnetix
Try Vulnetix Request Demo
CVE-2017-2666 PUBLISHED

It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.

EPSS 1.39% · 80.3th percentile

Risk Scores

EPSS Score
1.39%
80.3th percentile

Affected Products

VendorProductVersions
Ubuntu:24.04:LTSundertow0, 2.3.8-2
Ubuntu:16.04:LTSundertow1.3.5-1, 1.3.7-1, 0

Timeline

References

Open in Interactive Console →