PT-2020-6898 · Apache+8 · Apache Httpclient+8
Published
2020-10-10
·
Updated
2025-12-01
·
CVE-2020-13956
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Apache HttpClient versions prior to 4.5.13 and 5.0.3
Description
The issue is related to the insufficient validation of input data in Apache HttpClient, which can lead to misinterpretation of malformed authority components in request URIs. This can cause the library to pick the wrong target host for request execution, potentially allowing a remote attacker to gain unauthorized access to protected data or modify, add, or delete protected data.
Recommendations
For versions prior to 4.5.13, update to version 4.5.13 or later.
For versions prior to 5.0.3, update to version 5.0.3 or later.
As a temporary workaround, ensure proper URIs are used for any S3 connectivity and implement appropriate controls around modifying such URIs in the connector's configuration.
Fix
XSS
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Apache Httpclient
Centos
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu