Input validation error in Undertow - CVE-2024-6162

Vulnerability identifier: #VU93102

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-6162

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when handling url-encoded request path information. A remote attacker can send a specially crafted HTTP request to the application and perform a denial of service (DoS) attack.

Undertow
IBM InfoSphere Information Server
Oracle Communications BRM - Elastic Charging Engine
IBM Watson Knowledge Catalog in Cloud Pak for Data
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Certificate Management
IBM Business Automation Manager Open Editions
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Unified Data Repository

Install updates from vendor's website.

Undertow - addressed in versions 2.2.33, 2.3.14
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
IBM Business Automation Manager Open Editions - update to 8.0.7
Oracle Communications BRM - Elastic Charging Engine - update to 12.0.0.8.0

• https://access.redhat.com/security/cve/CVE-2024-6162
• https://bugzilla.redhat.com/show_bug.cgi?id=2293069
• https://github.com/undertow-io/undertow/releases/tag/2.3.14.Final
• https://github.com/undertow-io/undertow/releases/tag/2.2.33.Final

• Multiple vulnerabilities in Undertow
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Input validation error in IBM InfoSphere Information Server
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Certificate Management
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Input validation error in Oracle Communications BRM - Elastic Charging Engine
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Watson Knowledge Catalog