by Kastro
Paper/Archive/CVE-2020-7611

CVE-2020-7611

snyk — All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request…

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 78.7.787 × 2015.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Header Injection due to not validating request headers passed to the client.

Affected

ProductAffectedFixed inSource
io.micronaut:micronaut-http-clientall versions before 1.2.11–CNA
io.micronaut:micronaut-http-clientall versions from 1.3.0 before 1.3.2–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsnyk.io/vuln/SNYK-JAVA-IOMICRONAUT-561342refgithub.com/micronaut-projects/micronaut-core/security/advisories/GHSA-694p-xrhg-x3wmrefgithub.com/micronaut-projects/micronaut-core/commit/9d1eff5c8df1d6cda1fe00ef046729b2a6abe7f1