Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2020-13956GHSA-7R82-7XV7-XCPJ

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the li

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 4.5.13, 5.0.3
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: yes
  • Technical impact: partial

Summary

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: partial

  3. Record last updated

Affected versions

  • n/a Apache HttpClient

    4.5.12 and prior, 5.0.2 and prior

  • org.apache.httpcomponents:httpclientMaven

    fixed in 4.5.13

  • org.apache.httpcomponents:httpclientMaven

    From 5.0.0 · fixed in 5.0.3

References 25

lists.apache.org