Login Request a demo
Medium severity · published Dec 2, 2020
CVE-2020-13956
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick…
5.3
CVSS
9%
EPSS
No
On KEV
Description
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)9.0% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
WebLogic Server · Oracle
12.2.1.4.0; 14.1.1.0.0 · source: NVD
AH
Apache HttpClient ·
4.5.12 and prior, 5.0.2 and prior · source: vendor
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
CG
Commerce Guided Search · Oracle
11.3.2 · source: NVD
CC
Communications Cloud Native Core Service Communication Proxy · Oracle
1.14.0 · source: NVD
DI
Data Integrator · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
HT
Httpclient · Apache
before 4.5.13; 5.0.0 before 5.0.3 · source: NVD
JE
JD Edwards Enterpriseone Orchestrator · Oracle
before 9.2.6.0 · source: NVD
JE
JD Edwards Enterpriseone Tools · Oracle
before 9.2.6.0 · source: NVD
ND
Nosql Database · Oracle
before 20.3 · source: NVD
PE
Peoplesoft Enterprise PT Peopletools · Oracle
8.57; 8.58; 8.59 · source: NVD
PE
Peoplesoft Enterprise Peopletools · Oracle
8.57; 8.58 · source: NVD
Affected product
WS
WebLogic Server
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-13956
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-13956
lists.apache.org
https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749%40%3Cissues.maven.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9%40%3Cdev.hive.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb%40%3Cissues.drill.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1%40%3Cissues.solr.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe%40%3Cissues.solr.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0%40%3Cdev.ranger.apache.org%3E
More from WebLogic Server
9.8
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
9.8
CVE-2020-14750
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14882
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14644
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-2883
Oracle WebLogic Server Unspecified Vulnerability