Vulnerability CVE-2021-20220


Published: 2021-02-23

Description:
A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity.

Type:

CWE-444

(Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling'))

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.8/10
4.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
None
Affected software
Redhat -> Undertow 

 References:
https://bugzilla.redhat.com/show_bug.cgi?id=1923133

Copyright 2024, cxsecurity.com

 

Back to Top