Orta CVSS 5.3

CVE-2020-13956: Httpclient: hatalı girdi doğrulama

Yayın: 2 Aralık 2020 20:15 · Güncelleme: 6 Kasım 2026 09:46

Açıklama (NVD)

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

Özet bilgiler

Ürün: Apache Httpclient
CVSS v3.1: 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS: %9,03 (yüzdelik 95)
CWE: CWE-20
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
apache-httpclient	—	—	4.5.13
apache-httpclient	5.0.0	—	5.0.3
quarkus-quarkus	—	—	1.7.6
oracle-data-integrator	12.2.1.3.0	12.2.1.3.0	—
oracle-data-integrator	12.2.1.4.0	12.2.1.4.0	—
oracle-jd-edwards-enterpriseone-orchestrator	—	—	9.2.6.0
oracle-jd-edwards-enterpriseone-tools	—	—	9.2.6.0
oracle-nosql-database	—	—	20.3
oracle-peoplesoft-enterprise-peopletools	8.57	8.57	—
oracle-peoplesoft-enterprise-peopletools	8.58	8.58	—
oracle-peoplesoft-enterprise-pt-peopletools	8.57	8.57	—
oracle-peoplesoft-enterprise-pt-peopletools	8.58	8.58	—
oracle-peoplesoft-enterprise-pt-peopletools	8.59	8.59	—
oracle-primavera-unifier	17.7	17.12	—
oracle-primavera-unifier	16.1	16.1	—
oracle-primavera-unifier	16.2	16.2	—
oracle-primavera-unifier	18.8	18.8	—
oracle-primavera-unifier	19.12	19.12	—
oracle-primavera-unifier	20.12	20.12	—
oracle-retail-customer-management-and-segmentation-foundation	16.0	19.0	—
oracle-spatial-studio	—	—	20.1.1
oracle-sql-developer	—	—	20.4.1.407.0006
netapp-active-iq-unified-manager	—	—	—
netapp-active-iq-unified-manager	—	—	—
netapp-active-iq-unified-manager	—	—	—
netapp-snapcenter	—	—	—
oracle-commerce-guided-search	11.3.2	11.3.2	—
oracle-communications-cloud-native-core-service-communication-proxy	1.14.0	1.14.0	—
oracle-sql-developer	—	—	21.99
oracle-weblogic-server	12.2.1.4.0	12.2.1.4.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları