medium5.3
CVE-2020-1710
The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400.
Impact
The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Jboss Data Grid | All versions Version 7.0.0 |
| Redhat | Jboss Enterprise Application Platform | All versions Versions 6.4.21, 7.0.0, 7.2.0, 7.3.0 |
| Redhat | Openshift Application Runtimes | All versions |
| Redhat | Single Sign-On | All versions |