#VU47481 Input validation error in Apache HttpComponents - CVE-2020-13956
Published: October 9, 2020
Vulnerability identifier: #VU47481
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2020-13956
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Apache HttpComponents
Apache HttpComponents
Software vendor:
Apache Foundation
Apache Foundation
Description
The vulnerability allows a remote attacker to compromise the affected application.
The vulnerability exists due to insufficient validation of user-supplied input in Apache HttpClient. A remote attacker can pass request URIs to the library as java.net.URI object and force the application to pick the wrong target host for request execution.
Remediation
Install updates from vendor's website.