תיאור (מקור, אנגלית)
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
מוצרים מושפעים
apache: httpclient; quarkus: quarkus; oracle: data integrator; oracle: jd edwards enterpriseone orchestrator; oracle: jd edwards enterpriseone tools; oracle: nosql database; oracle: peoplesoft enterprise peopletools; oracle: peoplesoft enterprise pt peopletools; oracle: primavera unifier; oracle: retail customer management and segmentation foundation; oracle: spatial studio; oracle: sql developer; netapp: active iq unified manager; netapp: snapcenter; oracle: commerce guided search
קישורים10
- lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a1… Mailing ListVendor Advisory
- lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a1… Mailing ListVendor Advisory
- www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuApr2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
- www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuApr2021.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
- www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
מדדים
- CVSS 3.1
-
5.3
MEDIUM
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - EPSS — סבירות ניצול
- 9% אחוזון 95 · נכון ל-11 בנובמבר 2026
- CWE
- CWE-20
האם אפשר לנצל את הפגיעות הזו אצלכם?
עדכון אבטחה סוגר את הפרצה הידועה. בדיקת חדירות מראה לאן תוקף עדיין יכול להגיע — עם הוכחה.