Skip to main content

Httpclient CVE-2020-13956

MEDIUM
2020-12-02 security@apache.org
Apache Information Disclosure Httpclient Quarkus Data Integrator Jd Edwards Enterpriseone Orchestrator Jd Edwards Enterpriseone Tools Nosql Database Peoplesoft Enterprise Peopletools Peoplesoft Enterprise Pt Peopletools Primavera Unifier Retail Customer Management And Segmentation Foundation Spatial Studio Sql Developer Active Iq Unified Manager Snapcenter Commerce Guided Search Communications Cloud Native Core Service Communication Proxy Weblogic Server
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Dec 02, 2020 - 17:15 nvd
MEDIUM 5.3

DescriptionNVD

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

AnalysisAI

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution. Affected products include: Apache Httpclient, Quarkus, Oracle Data Integrator, Oracle Jd Edwards Enterpriseone Orchestrator, Oracle Jd Edwards Enterpriseone Tools. Version information: version 4.5.13.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Httpclient

View all
CVE-2014-3577 MEDIUM POC
5.8 Aug 21

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.
CVE-2013-4366 CRITICAL
9.8 Oct 30

http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifie
CVE-2020-15094 HIGH
8.8 Sep 02

In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on
CVE-2025-27820 HIGH
7.5 Apr 24

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host na
CVE-2012-5783 MEDIUM
5.8 Nov 04

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, d
CVE-2015-5262 MEDIUM
4.3 Oct 27

http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.t
CVE-2024-50342 MEDIUM
4.3 Nov 06

symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources s

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2020-13956 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy