A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5856 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.1.7 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.1.6, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 7.1.7 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * undertow: EAP: field-name is not parsed in accordance to RFC7230 [eap-7.1.z] (CVE-2020-1710)

    * commons-beanutils: apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean     by default [eap-7.1.z] (CVE-2019-10086)

    * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink [eap-7.1.z]     (CVE-2022-23302)

    * jackson-databind: default typing mishandling leading to remote code execution [eap-7.1.z]     (CVE-2019-14379)

    * undertow: HTTP/2: flood using HEADERS frames results in unbounded memory growth [eap-7.1.z]     (CVE-2019-9514)

    * undertow: AJP File Read/Inclusion Vulnerability [eap-7.1.z] (CVE-2020-1745)

    * undertow: HTTP/2: large amount of data requests leads to denial of service [eap-7.1.z] (CVE-2019-9511)

    * undertow: servletPath in normalized incorrectly leading to dangerous application mapping which could     result in security bypass [eap-7.1.z] (CVE-2020-1757)

    * undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS [eap-7.1.z]     (CVE-2019-14888)

    * log4j: Unsafe deserialization flaw in Chainsaw log viewer [eap-7.1.z] (CVE-2022-23307)

    * netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length     header [eap-7.1.z] (CVE-2019-20445)

    * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender [eap-7.1.z]     (CVE-2021-4104)

    * undertow: HTTP/2: flood using SETTINGS frames results in unbounded memory growth [eap-7.1.z]     (CVE-2019-9515)

    * infinispan-core: infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private     methods [eap-7.1.z] (CVE-2019-10174)

    * log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender [eap-7.1.z]     (CVE-2022-23305)

    * jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to     remote code execution [eap-7.1.z] (CVE-2019-12384)

    * wildfly-security-manager: security manager authorization bypass (CVE-2019-14843)

    * HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

    * netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers (CVE-2019-16869)

    * jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.* (CVE-2019-17531)

    * netty: HTTP request smuggling (CVE-2019-20444)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.9.0. It is affected by the following vulnerability:

  - A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009     in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could     exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable     server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file     types and trigger this vulnerability to gain remote code execution. (CVE-2020-1745)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2513 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.3.1 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.3.0, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.3.1 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * cxf: reflected XSS in the services listing page (CVE-2019-17573)

    * cxf-core: cxf: OpenId Connect token service does not properly validate the clientId (CVE-2019-12423)

    * jackson-mapper-asl: XML external entity similar to CVE-2016-3720 (CVE-2019-10172)

    * undertow: servletPath in normalized incorrectly leading to dangerous application mapping which could     result in security bypass (CVE-2020-1757)

    * jackson-databind: XML external entity similar to CVE-2016-3720 (CVE-2019-10172)

    * jackson-mapper-asl: XML external entity similar to CVE-2016-3720 (CVE-2019-10172)

    * resteasy-jaxrs: resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class     (CVE-2020-1695)

    * cryptacular: excessive memory allocation during a decode operation (CVE-2020-7226)

    * smallrye-config: SmallRye: SecuritySupport class is incorrectly public and contains a static method to     access the current threads context class loader (CVE-2020-1729)

    * resteasy: RESTEASY003870 exception in RESTEasy can lead to a reflected XSS attack (CVE-2020-10688)

    * jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)

    * undertow: invalid HTTP request with large chunk size (CVE-2020-10719)

    * jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)

    * jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)

    * jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)

    * undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745)

    * libthrift: thrift: Endless loop when feed with specific input data (CVE-2019-0205)

    * libthrift: thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol (CVE-2019-0210)

    * wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider     is in use (CVE-2019-14887)

    * jsf-impl: Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of     CVE-2018-14371 (CVE-2020-6950)

    * jsf-impl: mojarra: Path traversal in ResourceManager.java:getLocalePrefix() via the loc parameter     (CVE-2018-14371)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2512 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java     applications based on the WildFly application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.3.1 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.3.0, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.3.1 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * cxf: reflected XSS in the services listing page (CVE-2019-17573)

    * cxf-core: cxf: OpenId Connect token service does not properly validate the clientId (CVE-2019-12423)

    * jackson-mapper-asl: XML external entity similar to CVE-2016-3720 (CVE-2019-10172)

    * undertow: servletPath in normalized incorrectly leading to dangerous application mapping which could     result in security bypass (CVE-2020-1757)

    * jackson-databind: XML external entity similar to CVE-2016-3720 (CVE-2019-10172)

    * jackson-mapper-asl: XML external entity similar to CVE-2016-3720 (CVE-2019-10172)

    * resteasy-jaxrs: resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class     (CVE-2020-1695)

    * cryptacular: excessive memory allocation during a decode operation (CVE-2020-7226)

    * smallrye-config: SmallRye: SecuritySupport class is incorrectly public and contains a static method to     access the current threads context class loader (CVE-2020-1729)

    * resteasy: RESTEASY003870 exception in RESTEasy can lead to a reflected XSS attack (CVE-2020-10688)

    * jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)

    * undertow: invalid HTTP request with large chunk size (CVE-2020-10719)

    * jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)

    * jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)

    * jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)

    * undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745)

    * libthrift: thrift: Endless loop when feed with specific input data (CVE-2019-0205)

    * libthrift: thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol (CVE-2019-0210)

    * wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider     is in use (CVE-2019-14887)

    * jsf-impl: Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of     CVE-2018-14371 (CVE-2020-6950)

    * jsf-impl: mojarra: Path traversal in ResourceManager.java:getLocalePrefix() via the loc parameter     (CVE-2018-14371)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2511 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.3.1 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.3.0, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.3.1 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * cxf: reflected XSS in the services listing page (CVE-2019-17573)

    * cxf-core: cxf: OpenId Connect token service does not properly validate the clientId (CVE-2019-12423)

    * jackson-mapper-asl: XML external entity similar to CVE-2016-3720 (CVE-2019-10172)

    * undertow: servletPath in normalized incorrectly leading to dangerous application mapping which could     result in security bypass (CVE-2020-1757)

    * jackson-databind: XML external entity similar to CVE-2016-3720 (CVE-2019-10172)

    * jackson-mapper-asl: XML external entity similar to CVE-2016-3720 (CVE-2019-10172)

    * resteasy-jaxrs: resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class     (CVE-2020-1695)

    * cryptacular: excessive memory allocation during a decode operation (CVE-2020-7226)

    * smallrye-config: SmallRye: SecuritySupport class is incorrectly public and contains a static method to     access the current threads context class loader (CVE-2020-1729)

    * resteasy: RESTEASY003870 exception in RESTEasy can lead to a reflected XSS attack (CVE-2020-10688)

    * jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)

    * undertow: invalid HTTP request with large chunk size (CVE-2020-10719)

    * jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)

    * jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)

    * jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)

    * undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745)

    * libthrift: thrift: Endless loop when feed with specific input data (CVE-2019-0205)

    * libthrift: thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol (CVE-2019-0210)

    * wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider     is in use (CVE-2019-14887)

    * jsf-impl: Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of     CVE-2018-14371 (CVE-2020-6950)

    * jsf-impl: mojarra: Path traversal in ResourceManager.java:getLocalePrefix() via the loc parameter     (CVE-2018-14371)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2059 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.8 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.2.7, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.2.8 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * cxf: reflected XSS in the services listing page (CVE-2019-17573)

    * smallrye-config: SmallRye: SecuritySupport class is incorrectly public and contains a static method to     access the current threads context class loader (CVE-2020-1729)

    * jackson-databind: XML external entity similar to CVE-2016-3720 (CVE-2019-10172)

    * wildfly: Soteria: security identity corruption across concurrent threads (CVE-2020-1732)

    * undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745)

    * cryptacular: excessive memory allocation during a decode operation (CVE-2020-7226)

    * cxf-core: cxf: OpenId Connect token service does not properly validate the clientId (CVE-2019-12423)

    * undertow: servletPath in normalized incorrectly leading to dangerous application mapping which could     result in security bypass (CVE-2020-1757)

    * wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security     Domain (CVE-2020-1719)

    * undertow: invalid HTTP request with large chunk size (CVE-2020-10719)

    * undertow: Memory exhaustion issue in HttpReadListener via Expect:
    100-continue header (CVE-2020-10705)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2060 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.8 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.2.7, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.2.8 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * cxf: reflected XSS in the services listing page (CVE-2019-17573)

    * smallrye-config: SmallRye: SecuritySupport class is incorrectly public and contains a static method to     access the current threads context class loader (CVE-2020-1729)

    * jackson-databind: XML external entity similar to CVE-2016-3720 (CVE-2019-10172)

    * wildfly: Soteria: security identity corruption across concurrent threads (CVE-2020-1732)

    * undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745)

    * cryptacular: excessive memory allocation during a decode operation (CVE-2020-7226)

    * cxf-core: cxf: OpenId Connect token service does not properly validate the clientId (CVE-2019-12423)

    * undertow: servletPath in normalized incorrectly leading to dangerous application mapping which could     result in security bypass (CVE-2020-1757)

    * wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security     Domain (CVE-2020-1719)

    * undertow: invalid HTTP request with large chunk size (CVE-2020-10719)

    * undertow: Memory exhaustion issue in HttpReadListener via Expect:
    100-continue header (CVE-2020-10705)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2058 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.8 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.2.7, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.2.8 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * cxf: reflected XSS in the services listing page (CVE-2019-17573)

    * smallrye-config: SmallRye: SecuritySupport class is incorrectly public and contains a static method to     access the current threads context class loader (CVE-2020-1729)

    * jackson-databind: XML external entity similar to CVE-2016-3720 (CVE-2019-10172)

    * wildfly: Soteria: security identity corruption across concurrent threads (CVE-2020-1732)

    * undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745)

    * cryptacular: excessive memory allocation during a decode operation (CVE-2020-7226)

    * cxf-core: cxf: OpenId Connect token service does not properly validate the clientId (CVE-2019-12423)

    * undertow: servletPath in normalized incorrectly leading to dangerous application mapping which could     result in security bypass (CVE-2020-1757)

    * wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security     Domain (CVE-2020-1719)

    * undertow: invalid HTTP request with large chunk size (CVE-2020-10719)

    * undertow: Memory exhaustion issue in HttpReadListener via Expect: 100-continue header (CVE-2020-10705)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the apache package has been released.

The remote Redhat Enterprise Linux 6 / 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0962 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    Security Fix(es):

    * The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use     (CVE-2019-14887)

    * libthrift: thrift: Endless loop when feed with specific input data (CVE-2019-0205)

    * libthrift: thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol (CVE-2019-0210)

    * undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A file read/inclusion vulnerability was found in AJP connector. A  remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and gain remote code execution (RCE).

The remote Redhat Enterprise Linux 6 / 7 / 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:0813 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This asynchronous patch is a security update for the Undertow package in Red Hat JBoss Enterprise     Application Platform 7.2 for Red Hat Enterprise Linux 6, 7, and 8.

    Security Fix(es):

    * undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
206210	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 (RHSA-2024:5856)	Nessus	Red Hat Local Security Checks	critical
147721	JFrog < 7.9.0 File Inclusion Vulnerability	Nessus	Misc.	critical
137334	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.3.1 Security update (Important) (RHSA-2020:2513)	Nessus	Red Hat Local Security Checks	critical
137333	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.1 Security update (Important) (RHSA-2020:2512)	Nessus	Red Hat Local Security Checks	critical
137331	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.3.1 Security update (Important) (RHSA-2020:2511)	Nessus	Red Hat Local Security Checks	critical
136498	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 7 (RHSA-2020:2059)	Nessus	Red Hat Local Security Checks	critical
136495	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 8 (RHSA-2020:2060)	Nessus	Red Hat Local Security Checks	critical
136494	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 6 (RHSA-2020:2058)	Nessus	Red Hat Local Security Checks	critical
134872	Photon OS 3.0: Apache PHSA-2020-3.0-0069	Nessus	PhotonOS Local Security Checks	critical
134870	RHEL 6 / 7 / 8 : Red Hat JBoss Enterprise Application Platform 7.3 (RHSA-2020:0962)	Nessus	Red Hat Local Security Checks	critical
134862	Apache Tomcat AJP Connector Request Injection (Ghostcat)	Nessus	Web Servers	critical
134615	RHEL 6 / 7 / 8 : Red Hat JBoss Enterprise Application Platform 7.2 (RHSA-2020:0813)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2020-1745

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical