GitHub Advisoryadvisory · Maven

GHSA-pp3c-cf6j-m3ff Server-Side Request Forgery in Jodd HTTP

HIGH Published 2022-06-07 Modified 2022-06-15 Official page ↗
Aliases
CVE-2022-29631
Ecosystem
Maven
Packages
org.jodd:jodd-http
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-74, CWE-918
Reviewed
2022-06-07

Affected packages

• Maven org.jodd:jodd-http: >= 5.0.0, < 6.2.1 → fixed in 6.2.1

Description

Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers to execute Server-Side Request Forgery (SSRF) via a crafted TCP payload.

Related

Alias · CVE (1)

  • CVE-2022-29631 Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and… vulnerability

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-918 Server-Side Request Forgery weakness

References