Lucene search

[email protected]CVE-2020-11078

HistoryMay 20, 2020 - 4:15 p.m.

CVE-2020-11078

2020-05-2016:15:10

CWE-93

CWE-74

[email protected]

web.nvd.nist.gov

274

cve-2020-11078

httplib2

vulnerability

request headers

software security

nvd

uri manipulation

urllib

string concatenation

escaping

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

6.5 Medium

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

75.9%

JSON

In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for httplib2.Http.request() could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.

Affected configurations

Vulners

NVD

Node

httplib2httplib2Range<0.81.0

CPENameOperatorVersion
httplib2_project:httplib2httplib2 project httplib2lt0.18.0

CPE	Name	Operator	Version
httplib2_project:httplib2	httplib2 project httplib2	lt	0.18.0

CNA Affected

[
  {
    "product": "httplib2",
    "vendor": "httplib2",
    "versions": [
      {
        "status": "affected",
        "version": "< 0.81.0"
      }
    ]
  }
]