Description
The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.
Remediation
References
Related Vulnerabilities
WordPress Plugin Relevanssi-A Better Search SQL Injection (3.2)
MySQL CVE-2022-21482 Vulnerability (CVE-2022-21482)
Claroline Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2006-4844)
WordPress Plugin Oleggo LiveStream Cross-Site Scripting (0.2.6)
Drupal Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2008-3220)