What is CVE-2019-10184?

CVE-2019-10184 is a high-severity vulnerability in Netapp Active_iq_unified_manager, classified under Missing Authorization. CVSS score: 7.5/10. Published 2019-07-25.

How severe is CVE-2019-10184?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2019-10184 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Netapp Active_iq_unified_manager

CVE-2019-10184

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Vulnerability class: Broken Access Control

EPSS: 0.035 (87.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Netapp Active_iq_unified_manager
Undertow-io Undertow — versions fixed in 2.0.23.Final
Redhat Enterprise_linux — versions 8.0, 7.0, 6.0
Redhat Jboss_data_grid
Redhat Jboss_enterprise_application_platform — versions 7.0.0, 7.2, 7.3
Redhat Openshift_application_runtimes — versions 1.0
Redhat Single_sign-on — versions 7.0, 7.3
Redhat Undertow

Weakness classification (CWE)

CWE-862 — Missing Authorization

Public proof-of-concept exploits

WHATSUPTOYOU/FIND-VUL

References

secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2019-10184?: CVE-2019-10184 is a high-severity vulnerability in Netapp Active_iq_unified_manager, classified under Missing Authorization. CVSS score: 7.5/10. Published 2019-07-25.
How severe is CVE-2019-10184?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2019-10184 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.