CVE-2020-13956

MEDIUM5.3

Description

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected products

apache / httpclient4.5.13
NetApp / active_iq_unified_manager
NetApp / active_iq_unified_manager
NetApp / active_iq_unified_manager
NetApp / SnapCenter
oracle / commerce_guided_search11.3.2 – 11.3.2
oracle / communications_cloud_native_core_service_communication_proxy1.14.0 – 1.14.0
oracle / data_integrator12.2.1.4.0 – 12.2.1.4.0
oracle / data_integrator12.2.1.3.0 – 12.2.1.3.0
oracle / jd_edwards_enterpriseone_orchestrator9.2.6.0
oracle / jd_edwards_enterpriseone_tools9.2.6.0
oracle / nosql_database20.3
oracle / peoplesoft_enterprise_peopletools8.58 – 8.58
oracle / peoplesoft_enterprise_peopletools8.57 – 8.57
oracle / peoplesoft_enterprise_pt_peopletools8.59 – 8.59
oracle / peoplesoft_enterprise_pt_peopletools8.58 – 8.58
oracle / peoplesoft_enterprise_pt_peopletools8.57 – 8.57
oracle / primavera_unifier16.2 – 16.2
oracle / primavera_unifier17.7 – 17.12
oracle / primavera_unifier16.1 – 16.1
oracle / primavera_unifier18.8 – 18.8
oracle / primavera_unifier19.12 – 19.12
oracle / primavera_unifier20.12 – 20.12
oracle / retail_customer_management_and_segmentation_foundation16.0 – 19.0
oracle / spatial_studio20.1.1
oracle / sql_developer20.4.1.407.0006
oracle / weblogic_server12.2.1.4.0 – 12.2.1.4.0
oracle / weblogic_server14.1.1.0.0 – 14.1.1.0.0
Quarkus / quarkus1.7.6

References

Updated 16m ago · 8 sources