Description
The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.
Remediation
References
Related Vulnerabilities
WordPress Plugin Booster for WooCommerce Multiple Cross-Site Scripting Vulnerabilities (5.4.8)
WordPress Plugin Users Ultra SQL Injection (1.4.35)
Oracle JRE CVE-2024-20955 Vulnerability (CVE-2024-20955)
Apache Tomcat Other Vulnerability (CVE-2001-0917)
WordPress Plugin Duplicator-WordPress Migration Arbitrary File Download (1.3.26)