CVE-2019-3888 Credential exposure through log files in Undertow

What is CVE-2019-3888?

CVE-2019-3888 is a medium-severity vulnerability in Netapp Active Iq Unified Manager, published on 12 Jun 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)

Weakness: CWE-532

Which versions are affected by CVE-2019-3888?

2 open source packages ship an affected version, including io.undertow:undertow-core. It affects 6 products.

Products include Netapp Active Iq Unified Manager, Redhat Jboss Data Grid, Redhat Openshift Application Runtimes, Redhat Undertow, Redhat Virtualization, Redhat Virtualization Host.

How do I fix CVE-2019-3888?

Upgrade io.undertow:undertow-core to 2.0.21 or later.

Is CVE-2019-3888 being exploited?

There is no known exploitation of CVE-2019-3888 in the wild and no public exploit code.

Other vulnerabilities in Netapp Active Iq Unified Manager

• CVE-2022-31692 Spring Security authorization rules can be bypassed via forward or include dispatcher types Critical 9.8
• CVE-2022-2526 Use after free in systemd-resolved Critical 9.8
• CVE-2022-22978 Authorization bypass in Spring Security Critical 9.8
• CVE-2021-22931 Code injection in Node Critical 9.8
• CVE-2018-2938 Code injection in Java Critical 9.0

All Netapp Active Iq Unified Manager vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-3888, GHSA-jwgx-9mmh-684w, UBUNTU-CVE-2019-3888.