CVE-2020-1710 Other in JBoss Enterprise Application Platform
JBoss EAP fails to reject malformed HTTP headers per RFC7230, returning 200 instead of 400, potentially causing request smuggling or cache poisoning.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-1710?
CVE-2020-1710 is a medium-severity vulnerability in Redhat Jboss Enterprise Application Platform, published on 16 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400.
Which versions are affected by CVE-2020-1710?
It affects 4 products.
Products include Redhat Jboss Data Grid, Redhat Jboss Enterprise Application Platform, Redhat Openshift Application Runtimes, Redhat Single Sign-On.
How do I fix CVE-2020-1710?
Apply the vendor's patch.
Is CVE-2020-1710 being exploited?
There is no known exploitation of CVE-2020-1710 in the wild and no public exploit code.
Other vulnerabilities in Redhat Jboss Enterprise Application Platform
- CVE-2020-1757 Improper Input Validation in Undertow
- CVE-2019-14887 Inadequate Encryption Strength and Algorithm Downgrade in Wildfly
All Redhat Jboss Enterprise Application Platform vulnerabilities
Sources
Also known as GHSA-xqwp-g97m-cxpr.