CVE-2021-20220

Опубликовано: 23 фев. 2021

Источник: nvd

CVSS3: 4.8

CVSS2: 5.8

EPSS Низкий

Описание

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity.

Ссылки

https://bugzilla.redhat.com/show_bug.cgi?id=1923133
Issue Tracking
Vendor Advisory
https://security.netapp.com/advisory/ntap-20220210-0013/
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1923133
Issue Tracking
Vendor Advisory
https://security.netapp.com/advisory/ntap-20220210-0013/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*

Версия до 2.0.34 (исключая)

cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*

Версия от 2.1.0 (включая) до 2.1.6 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*

cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*

EPSS

Процентиль: 40%

0.00182

Низкий

4.8 Medium

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-444

Связанные уязвимости

CVE-2021-20220

CVSS3: 4.8

ubuntu

почти 5 лет назад

CVE-2021-20220

CVSS3: 4.8

redhat

около 5 лет назад

CVE-2021-20220

CVSS3: 4.8

debian

почти 5 лет назад

A flaw was found in Undertow. A regression in the fix for CVE-2020-106 ...

GHSA-qjwc-v72v-fq6r

CVSS3: 4.8

github

больше 4 лет назад

HTTP request smuggling in Undertow

EPSS

Процентиль: 40%

0.00182

Низкий

4.8 Medium

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-444