CVE-2020-7764 Web Cache Poisoning
Attackers can cause denial of service via web cache poisoning using the Accept-Version header in the find-my-way routing library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7764?
CVE-2020-7764 is a medium-severity vulnerability in find-my-way, published on 8 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed header in a cache poisoning attack.
Weakness: CWE-444
Which versions are affected by CVE-2020-7764?
4 open source packages ship an affected version, including find-my-way. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
find-my-way npm | All versions | 2.2.5 |
find-my-way npm | All versions | 2.2.5 |
find-my-way npm | From 3.0.0 | 3.0.5 |
find-my-way npm | From 3.0.0 | 3.0.5 |
Products include Find-My-Way Project Find-My-Way.
How do I fix CVE-2020-7764?
Upgrade find-my-way to a fixed version for your release line: 2.2.5 or 3.0.5.
Is CVE-2020-7764 being exploited?
There is no known exploitation of CVE-2020-7764 in the wild and no public exploit code.
Sources
Also known as GHSA-jgrh-5m3h-9c5f, SNYK-JS-FINDMYWAY-1038269.