CVE-2020-1695
Severity
7.5HIGH
EPSS
0.8%
top 26.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 19
Latest updateJul 10
Description
A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6
Affected Packages5 packages
▶CVEListV5red_hat/resteasyall resteasy 3.x.x versions prior to 3.12.0.Final, all resteasy 4.x.x versions prior to 4.6.0.Final+1
Also affects: Fedora 32, 33
Patches
🔴Vulnerability Details
5📋Vendor Advisories
5💬Community
3Bugzilla▶
CVE-2020-1695 resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class [fedora-all]↗2020-06-09
Bugzilla▶
CVE-2020-2103 jenkins: Exposed session identifiers on user detail object in the whoAmI diagnostic page↗2020-01-31
Bugzilla▶
CVE-2020-1695 resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class↗2019-07-16