Lucene search

[email protected]CVE-2020-1695

HistoryMay 19, 2020 - 3:15 p.m.

CVE-2020-1695

2020-05-1915:15:11

CWE-20

[email protected]

web.nvd.nist.gov

113

cve-2020-1695

resteasy

input validation

injection

http response

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.6%

JSON

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server’s response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.

Affected configurations

Vulners

NVD

Node

redhatresteasyRange3.0.0–3.12.0

redhatresteasyRange4.0.0–4.6.0

VendorProductVersionCPE
redhatresteasy*cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:*
redhatresteasy*cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	resteasy	*	cpe:2.3:a:redhat:resteasy::::::::
redhat	resteasy	*	cpe:2.3:a:redhat:resteasy::::::::

CNA Affected

[
  {
    "product": "resteasy",
    "vendor": "Red Hat",
    "versions": [
      {
        "status": "affected",
        "version": "all resteasy 3.x.x versions prior to 3.12.0.Final"
      },
      {
        "status": "affected",
        "version": "all resteasy 4.x.x versions prior to 4.6.0.Final"
      }
    ]
  }
]