What is the CVSS score of CVE-2020-27218?

CVE-2020-27218 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 8.1%.

Is there a patch available for CVE-2020-27218?

Yes, a patch is available for CVE-2020-27218. Update the affected software to the latest version immediately.

Jetty CVE-2020-27218

MEDIUM

Sensitive Information in Resource Not Removed Before Reuse (CWE-226)

2020-11-28 emo@eclipse.org

Code Injection Jetty Oncommand System Manager Snap Creator Framework Blockchain Platform Communications Converged Application Server Service Controller Communications Offline Mediation Controller Communications Pricing Design Center Communications Services Gatekeeper Communications Session Route Manager Flexcube Private Banking Hyperion Infrastructure Technology Rest Data Services Retail Eftlink Siebel Core Automation Kafka Spark Debian Linux

4.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

CVE Published

Nov 28, 2020 - 01:15 nvd

MEDIUM 4.8

DescriptionNVD

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-226. In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request. Affected products include: Eclipse Jetty, Netapp Oncommand System Manager, Netapp Snap Creator Framework, Oracle Blockchain Platform, Oracle Communications Converged Application Server - Service Controller. Version information: version 9.4.0..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.