NetSight
IP …
medium5.3

CVE-2020-13956

Cross-site scripting in Apache HttpClient

Impact

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.httpcomponents:httpclient< 4.5.134.5.13

Affected products

VendorProductAffected versions
ApacheHttpclient
before 4.5.13
from 5.0.0 before 5.0.3
QuarkusQuarkus
before 1.7.6
OracleData Integrator
Versions 12.2.1.3.0, 12.2.1.4.0
OracleJd Edwards Enterpriseone Orchestrator
before 9.2.6.0
OracleJd Edwards Enterpriseone Tools
before 9.2.6.0
OracleNosql Database
before 20.3
OraclePeoplesoft Enterprise Peopletools
Versions 8.57, 8.58
OraclePeoplesoft Enterprise Pt Peopletools
Versions 8.57, 8.58, 8.59
OraclePrimavera Unifier
from 17.7 through 17.12
Versions 16.1, 16.2, 18.8, 19.12, 20.12
OracleRetail Customer Management And Segmentation Foundation
from 16.0 through 19.0
OracleSpatial Studio
before 20.1.1
OracleSql Developer
before 20.4.1.407.0006
before 21.99

Weakness classification

CWE-20CWE-79

References