CVE-2017-12196

CVE-2017-12196 is a medium-severity vulnerability affecting Undertow versions prior to 1.4.18.SP1, 2.0.2.Final, and 1.4.24.Final, as well as Red Hat JBoss Enterprise Application Platform, JBoss Fuse, Undertow, and Virtualization. It arises from a flaw in Digest authentication where the server fails to validate that the URI in the Authorization header matches the HTTP request line, enabling a Man-in-the-Middle (MITM) attack. This vulnerability has a CVSS score of 5.9, indicating a network-based attack with high impact on confidentiality, but requiring high attack complexity. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.