CVE-2020-11724 — HTTP Request Smuggling in Openresty

CWE-444 — HTTP Request Smuggling10 documents6 sources
Severity
7.5HIGHNVD
EPSS
2.5%
top 14.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
F5 NginxOpenrestyDebian Linux
Timeline
PublishedApr 12
Latest updateOct 7

Description

An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDopenresty/openresty< 1.15.8.4
▶Debianf5/nginx< 1.18.0-5+3
▶Ubuntuf5/nginx< 1.14.0-0ubuntu1.10+4

Also affects: Debian Linux 10.0, 9.0

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

6
OSV
nginx vulnerability↗2022-10-07
▶
GHSA
GHSA-478m-xrv3-7r93: An issue was discovered in OpenResty before 1↗2022-05-24
▶
OSV
nginx vulnerability↗2022-04-28
▶
OSV
nginx vulnerabilities↗2022-04-12
▶
OSV
CVE-2020-11724: An issue was discovered in OpenResty before 1↗2020-04-12
▶

📋Vendor Advisories

3
Ubuntu
nginx vulnerability↗2022-10-07
▶
Ubuntu
nginx vulnerabilities↗2022-04-12
▶
Debian
CVE-2020-11724: nginx - An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c ...↗2020
▶
CVE-2020-11724 — HTTP Request Smuggling in Openresty | cvebase