CVEvulnerability

CVE-2020-13956

5.3 MEDIUM Published 2020-12-02 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2020-12-02
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-20

Description

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

Affected configurations

• apache httpclient (< 4.5.13) • apache httpclient (>= 5.0.0 < 5.0.3) • quarkus quarkus (< 1.7.6) • oracle data integrator 12.2.1.3.0 • oracle data integrator 12.2.1.4.0 • oracle jd edwards enterpriseone orchestrator (< 9.2.6.0) • oracle jd edwards enterpriseone tools (< 9.2.6.0) • oracle nosql database (< 20.3) • oracle peoplesoft enterprise peopletools 8.57 • oracle peoplesoft enterprise peopletools 8.58 • oracle peoplesoft enterprise pt peopletools 8.57 • oracle peoplesoft enterprise pt peopletools 8.58 • oracle peoplesoft enterprise pt peopletools 8.59 • oracle primavera unifier (>= 17.7 <= 17.12) • oracle primavera unifier 16.1 • oracle primavera unifier 16.2 • oracle primavera unifier 18.8 • oracle primavera unifier 19.12 • oracle primavera unifier 20.12 • oracle retail customer management and segmentation foundation (>= 16.0 <= 19.0) • oracle spatial studio (< 20.1.1) • oracle sql developer (< 20.4.1.407.0006) • netapp active iq unified manager • netapp snapcenter • oracle commerce guided search 11.3.2 • oracle communications cloud native core service communication proxy 1.14.0 • oracle sql developer (< 21.99) • oracle weblogic server 12.2.1.4.0 • oracle weblogic server 14.1.1.0.0

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References