CVE Vulnerabilities

CVE-2020-1710

Published: Sep 16, 2020 | Modified: Sep 22, 2020
CVSS 3.x
5.3
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu

The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400.

Affected Software

Name Vendor Start Version End Version
Jboss_data_grid Redhat - (including) - (including)
Jboss_data_grid Redhat 7.0.0 (including) 7.0.0 (including)
Jboss_enterprise_application_platform Redhat - (including) - (including)
Jboss_enterprise_application_platform Redhat 6.4.21 (including) 6.4.21 (including)
Jboss_enterprise_application_platform Redhat 7.0.0 (including) 7.0.0 (including)
Jboss_enterprise_application_platform Redhat 7.2.0 (including) 7.2.0 (including)
Jboss_enterprise_application_platform Redhat 7.3.0 (including) 7.3.0 (including)
Openshift_application_runtimes Redhat - (including) - (including)
Single_sign-on Redhat - (including) - (including)

References