CVE-2020-13956

תיאור (מקור, אנגלית)

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

מדדים

CVSS 3.1

5.3 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS — סבירות ניצול

9% (אחוזון 100) נכון ל-18/10/2026

CWE

CWE-20

מוצרים מושפעים

apache: httpclient; quarkus: quarkus; oracle: data integrator; oracle: jd edwards enterpriseone orchestrator; oracle: jd edwards enterpriseone tools; oracle: nosql database; oracle: peoplesoft enterprise peopletools; oracle: peoplesoft enterprise pt peopletools; oracle: primavera unifier; oracle: retail customer management and segmentation foundation; oracle: spatial studio; oracle: sql developer; netapp: active iq unified manager; netapp: snapcenter; oracle: commerce guided search

קישורים

• https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e26‮… Mailing ListVendor Advisory
• https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e26‮… Mailing ListVendor Advisory
• https://www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
• https://www.oracle.com/security-alerts/cpuApr2021.html PatchThird Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory
• https://www.oracle.com//security-alerts/cpujul2021.html PatchThird Party Advisory
• https://www.oracle.com/security-alerts/cpuApr2021.html PatchThird Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.html PatchThird Party Advisory