CVE-2020-13956 Cross-site scripting in Apache HttpClient
Apache HttpClient may route requests to unintended hosts due to malformed URI parsing, enabling potential SSRF or security bypass.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-13956?
CVE-2020-13956 is a medium-severity server-side request forgery vulnerability in Netapp Active Iq Unified Manager, published on 2 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
Weakness: CWE-20
Which versions are affected by CVE-2020-13956?
4 open source packages ship an affected version, including org.apache.httpcomponents:httpclient. It affects 17 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.httpcomponents:httpclient Maven | All versions | 4.5.13 |
org.apache.httpcomponents:httpclient Maven | All versions | 4.5.13 |
org.apache.httpcomponents:httpclient Maven | From 5.0.0 | 5.0.3 |
org.apache.httpcomponents:httpclient Maven | From 5.0.0 | 5.0.3 |
Linux distribution packages (36)
aopalliance AlmaLinux:8 | All versions | 1.0-17.module_el8.6.0+2752+f1f3449e |
aopalliance AlmaLinux:8 | All versions | 1.0-20.module_el8.6.0+2786+d7c38b21 |
apache-commons-cli AlmaLinux:8 | All versions | 1.4-4.module_el8.6.0+2752+f1f3449e |
apache-commons-cli AlmaLinux:8 | All versions | 1.4-7.module_el8.6.0+2786+d7c38b21 |
apache-commons-codec AlmaLinux:8 | All versions | 1.11-3.module_el8.6.0+2752+f1f3449e |
apache-commons-codec AlmaLinux:8 | All versions | 1.13-3.module_el8.6.0+2786+d7c38b21 |
apache-commons-io AlmaLinux:8 | All versions | 1:2.6-3.module_el8.6.0+2752+f1f3449e |
apache-commons-io AlmaLinux:8 | All versions | 1:2.6-6.module_el8.6.0+2786+d7c38b21 |
apache-commons-lang3 AlmaLinux:8 | All versions | 3.7-3.module_el8.6.0+2752+f1f3449e |
apache-commons-lang3 AlmaLinux:8 | All versions | 3.9-4.module_el8.6.0+2786+d7c38b21 |
apache-commons-logging AlmaLinux:8 | All versions | 1.2-13.module_el8.6.0+2752+f1f3449e |
atinject AlmaLinux:8 | All versions | 1-28.20100611svn86.module_el8.6.0+2752+f1f3449e |
atinject AlmaLinux:8 | All versions | 1-31.20100611svn86.module_el8.6.0+2786+d7c38b21 |
cdi-api AlmaLinux:8 | All versions | 1.2-8.module_el8.6.0+2752+f1f3449e |
cdi-api AlmaLinux:8 | All versions | 2.0.1-3.module_el8.6.0+2786+d7c38b21 |
geronimo-annotation AlmaLinux:8 | All versions | 1.0-23.module_el8.6.0+2752+f1f3449e |
geronimo-annotation AlmaLinux:8 | All versions | 1.0-26.module_el8.6.0+2786+d7c38b21 |
glassfish-el-api AlmaLinux:8 | All versions | 3.0.1-0.7.b08.module_el8.6.0+2752+f1f3449e |
google-guice AlmaLinux:8 | All versions | 4.1-11.module_el8.6.0+2752+f1f3449e |
google-guice AlmaLinux:8 | All versions | 4.2.2-4.module_el8.6.0+2786+d7c38b21 |
guava AlmaLinux:8 | All versions | 28.1-3.module_el8.6.0+2786+d7c38b21 |
guava20 AlmaLinux:8 | All versions | 20.0-8.module_el8.6.0+2752+f1f3449e |
hawtjni-runtime AlmaLinux:8 | All versions | 1.16-2.module_el8.6.0+2752+f1f3449e |
httpcomponents-client AlmaLinux:8 | All versions | 4.5.10-4.module_el8.6.0+2786+d7c38b21 |
httpcomponents-client AlmaLinux:8 | All versions | 4.5.5-5.module_el8.6.0+2752+f1f3449e |
httpcomponents-core AlmaLinux:8 | All versions | 4.4.10-3.module_el8.6.0+2752+f1f3449e |
httpcomponents-core AlmaLinux:8 | All versions | 4.4.12-3.module_el8.6.0+2786+d7c38b21 |
jansi AlmaLinux:8 | All versions | 1.17.1-1.module_el8.0.0+6044+f3cbc35d |
jansi AlmaLinux:8 | All versions | 1.17.1-1.module_el8.4.0+2250+516cbbff |
jansi AlmaLinux:8 | All versions | 1.17.1-1.module_el8.6.0+2752+f1f3449e |
jansi AlmaLinux:8 | All versions | 1.18-4.module_el8.6.0+2786+d7c38b21 |
jansi-native AlmaLinux:8 | All versions | 1.7-7.module_el8.6.0+2752+f1f3449e |
jboss-interceptors-1.2-api AlmaLinux:8 | All versions | 1.0.0-8.module_el8.6.0+2752+f1f3449e |
jcl-over-slf4j AlmaLinux:8 | All versions | 1.7.25-4.module_el8.6.0+2752+f1f3449e |
jcl-over-slf4j AlmaLinux:8 | All versions | 1.7.28-3.module_el8.6.0+2786+d7c38b21 |
jsoup AlmaLinux:8 | All versions | 1.11.3-3.module_el8.6.0+2752+f1f3449e |
Products include Apache Httpclient, Netapp Active Iq Unified Manager, Netapp Snapcenter, Oracle Commerce Guided Search, Oracle Communications Cloud Native Core Service Communication Proxy, Oracle Data Integrator and 11 more.
How do I fix CVE-2020-13956?
Upgrade org.apache.httpcomponents:httpclient to a fixed version for your release line: 4.5.13 or 5.0.3.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-13956 being exploited?
There is no known exploitation of CVE-2020-13956 in the wild and no public exploit code.
Other vulnerabilities in Netapp Active Iq Unified Manager
- CVE-2013-4366 Hostname verification in Apache HttpClient 4.3 was disabled by default
- CVE-2026-71290 Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
- CVE-2025-27820 Apache HttpComponents: PSL (Public Suffix List) validation bypass
- CVE-2026-40542 Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification
- CVE-2012-5783 Improper Certificate Validation in Apache Commons HttpClient
Sources
Also known as ALSA-2022:1860, ALSA-2022:1861, CLEANSTART-2025-XW98156, CLSA-2025-1765325275, CLSA-2026-1784682871, CLSA-2026-1785291356 and 31 more.