VULNERABILITY INTELLIGENCE

CVE-2019-3888

CVSS score9.8 CRITICAL
EPSS probability3.03%
CISA KEVNot currently listed
Published2019-06-12
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)

Weakness classification

  • secalert@redhat.com: CWE-532
  • nvd@nist.gov: CWE-532

Primary references