CVE-2020-1695

2020-05-1914:13:10

CWE-20

redhat

www.cve.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.6%

JSON

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server’s response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.

CNA Affected

[
  {
    "product": "resteasy",
    "vendor": "Red Hat",
    "versions": [
      {
        "status": "affected",
        "version": "all resteasy 3.x.x versions prior to 3.12.0.Final"
      },
      {
        "status": "affected",
        "version": "all resteasy 4.x.x versions prior to 4.6.0.Final"
      }
    ]
  }
]