GitHub Advisoryadvisory · Maven

GHSA-7r82-7xv7-xcpj Cross-site scripting in Apache HttpClient

MEDIUM Published 2021-06-03 Modified 2022-02-08 Official page ↗
Aliases
CVE-2020-13956
Ecosystem
Maven
Packages
org.apache.httpcomponents:httpclient
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-04-12

Affected packages

• Maven org.apache.httpcomponents:httpclient: < 4.5.13 → fixed in 4.5.13 • Maven org.apache.httpcomponents:httpclient: >= 5.0.0, < 5.0.3 → fixed in 5.0.3

Description

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

Related

Alias · CVE (1)

  • CVE-2020-13956 Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References