HIGH 7.4 Maven
Undertow incorrectly parses cookies
GHSA-3jrv-jgp8-45v3 · CVE-2023-4639
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-4639
- WEB https://github.com/undertow-io/undertow/commit/1f93a979d2ac264798e5779b5b7172dfafe0066f
- WEB https://access.redhat.com/errata/RHSA-2024:1674
- WEB https://access.redhat.com/errata/RHSA-2024:1675
- WEB https://access.redhat.com/errata/RHSA-2024:1676
- WEB https://access.redhat.com/errata/RHSA-2024:1677
- WEB https://access.redhat.com/errata/RHSA-2024:2763
- WEB https://access.redhat.com/errata/RHSA-2024:2764
- WEB https://access.redhat.com/errata/RHSA-2024:3919
- WEB https://access.redhat.com/security/cve/CVE-2023-4639
- WEB https://bugzilla.redhat.com/show_bug.cgi?id=2166022
- PACKAGE https://github.com/undertow-io/undertow
- WEB https://security.netapp.com/advisory/ntap-20250207-0001
Ready to move
Start Securing
Free, no credit card | First findings in minutes