CVE-2023-4639 Vulnerability Details

  /     /     /  

CVE-2023-4639 Metadata Quick Info

CVE Published: 17/11/2024 | CVE Updated: 17/11/2024 | CVE Year: 2023
Source: redhat | Vendor: Red Hat | Product: Migration Toolkit for Runtimes 1 on RHEL 8
Status : PUBLISHED

---

CVE-2023-4639 Description

A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-444
CWE Name: Inconsistent Interpretation of HTTP Requests ( HTTP Request/Response Smuggling )
Source: Red Hat

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).