Description
A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own.
Remediation
References
Related Vulnerabilities
phpMyAdmin Improper Restriction of XML External Entity Reference Vulnerability (CVE-2011-4107)
MediaWiki CVE-2023-45370 Vulnerability (CVE-2023-45370)
WordPress Plugin Cashtomer SQL Injection (1.0.0)
Magento Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2015-1399)
WordPress Plugin Football Pool Arbitrary File Upload (2.6.3)