cvelistv5 - cve-2020-5280

CVE-2020-5280 (GCVE-0-2020-5280)

Vulnerability from cvelistv5

Published

2020-03-25 17:45

Modified

2024-08-04 08:22

Severity ?

7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

CWE

CWE-23 - Relative Path Traversal

Summary

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.

References

URL	Tags
security-advisories@github.com	https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec	Patch
security-advisories@github.com	https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca	Patch
security-advisories@github.com	https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b	Patch
security-advisories@github.com	https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6	Third Party Advisory

Impacted products

	Vendor	Product	Version
	http4s	http4s	Version: < 0.18.26 Version: >= 0.19.0, < 0.20.20 Version: >= 0.21.0, < 0.21.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:22:09.104Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "http4s",
          "vendor": "http4s",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.18.26"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.19.0, \u003c 0.20.20"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.21.0, \u003c 0.21.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23: Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-25T17:45:17",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b"
        }
      ],
      "source": {
        "advisory": "GHSA-66q9-f7ff-mmx6",
        "discovery": "UNKNOWN"
      },
      "title": "Local file inclusion vulnerability in http4s",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-5280",
          "STATE": "PUBLIC",
          "TITLE": "Local file inclusion vulnerability in http4s"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "http4s",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 0.18.26"
                          },
                          {
                            "version_value": "\u003e= 0.19.0, \u003c 0.20.20"
                          },
                          {
                            "version_value": "\u003e= 0.21.0, \u003c 0.21.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "http4s"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-23: Relative Path Traversal"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6",
              "refsource": "CONFIRM",
              "url": "https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6"
            },
            {
              "name": "https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec",
              "refsource": "MISC",
              "url": "https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec"
            },
            {
              "name": "https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca",
              "refsource": "MISC",
              "url": "https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca"
            },
            {
              "name": "https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b",
              "refsource": "MISC",
              "url": "https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-66q9-f7ff-mmx6",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-5280",
    "datePublished": "2020-03-25T17:45:17",
    "dateReserved": "2020-01-02T00:00:00",
    "dateUpdated": "2024-08-04T08:22:09.104Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2020-5280\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2020-03-25T18:15:14.237\",\"lastModified\":\"2024-11-21T05:33:49.547\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.\"},{\"lang\":\"es\",\"value\":\"http4s versiones anteriores a 0.18.26, 0.20.20 y 0.21.2, presenta una vulnerabilidad de inclusi\u00f3n de archivos local. Esta vulnerabilidad se aplica a todos los usuarios de org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService y org.http4s.server.staticcontent.WebjarService. La normalizaci\u00f3n de URI es aplicada incorrectamente. Las peticiones cuya informaci\u00f3n de ruta contiene ../ o // pueden exponer recursos fuera de la ubicaci\u00f3n configurada. Este problema est\u00e1 parcheado en las versiones 0.18.26, 0.20.20 y 0.21.2. Tome en cuenta que la versi\u00f3n 0.19.0 es una versi\u00f3n en desuso y nunca ha sido compatible.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N\",\"baseScore\":7.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":4.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-23\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"0.18.26\",\"matchCriteriaId\":\"D8F27ABA-D902-4EFB-AA8A-1C1A3637517A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.19.0\",\"versionEndExcluding\":\"0.20.20\",\"matchCriteriaId\":\"1B72AEE1-950A-4AB8-9620-A9E4DE39ACEB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.21.0\",\"versionEndExcluding\":\"0.21.2\",\"matchCriteriaId\":\"15358AD5-7CD3-4EC2-B986-6115420D15D8\"}]}]}],\"references\":[{\"url\":\"https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
  }
}

gsd-2020-5280

Vulnerability from gsd

Modified

2023-12-13 01:22

Details

Aliases

CVE-2020-5280

Aliases

CVE-2020-5280

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2020-5280",
    "description": "http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.",
    "id": "GSD-2020-5280"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2020-5280"
      ],
      "details": "http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.",
      "id": "GSD-2020-5280",
      "modified": "2023-12-13T01:22:03.785288Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2020-5280",
        "STATE": "PUBLIC",
        "TITLE": "Local file inclusion vulnerability in http4s"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "http4s",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c 0.18.26"
                        },
                        {
                          "version_value": "\u003e= 0.19.0, \u003c 0.20.20"
                        },
                        {
                          "version_value": "\u003e= 0.21.0, \u003c 0.21.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "http4s"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-23: Relative Path Traversal"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6",
            "refsource": "CONFIRM",
            "url": "https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6"
          },
          {
            "name": "https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec",
            "refsource": "MISC",
            "url": "https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec"
          },
          {
            "name": "https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca",
            "refsource": "MISC",
            "url": "https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca"
          },
          {
            "name": "https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b",
            "refsource": "MISC",
            "url": "https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-66q9-f7ff-mmx6",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "(,0.18.26),[0.19.0,0.20.20),[0.21.0,0.21.2)",
          "affected_versions": "All versions before 0.18.26, all versions starting from 0.19.0 before 0.20.20, all versions starting from 0.21.0 before 0.21.2",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-22",
            "CWE-937"
          ],
          "date": "2020-03-30",
          "description": "http4s has a local file inclusion vulnerability due to URI normalization being applied incorrectly. This vulnerability applies to all users of `org.http4s.server.staticcontent.FileService`, `org.http4s.server.staticcontent.ResourceService` and `org.http4s.server.staticcontent.WebjarService`.",
          "fixed_versions": [
            "0.21.2"
          ],
          "identifier": "CVE-2020-5280",
          "identifiers": [
            "CVE-2020-5280",
            "GHSA-66q9-f7ff-mmx6"
          ],
          "not_impacted": "All versions starting from 0.18.26 before 0.19.0, all versions starting from 0.20.20 before 0.21.0, all versions starting from 0.21.2",
          "package_slug": "maven/org.http4s/http4s-core_2.12",
          "pubdate": "2020-03-25",
          "solution": "Upgrade to version 0.21.2 or above.",
          "title": "Path Traversal",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2020-5280"
          ],
          "uuid": "564087d4-1840-44ca-b502-b40241a5ebbd"
        },
        {
          "affected_range": "(,0.18.26),[0.19.0,0.20.20),[0.21.0,0.21.2)",
          "affected_versions": "All versions before 0.18.26, all versions starting from 0.19.0 before 0.20.20, all versions starting from 0.21.0 before 0.21.2",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-22",
            "CWE-937"
          ],
          "date": "2021-01-14",
          "description": "http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.",
          "fixed_versions": [
            "0.18.26",
            "0.20.20",
            "0.21.2"
          ],
          "identifier": "CVE-2020-5280",
          "identifiers": [
            "GHSA-66q9-f7ff-mmx6",
            "CVE-2020-5280"
          ],
          "not_impacted": "All versions starting from 0.18.26 before 0.19.0, all versions starting from 0.20.20 before 0.21.0, all versions starting from 0.21.2",
          "package_slug": "maven/org.http4s/http4s-server_2.12",
          "pubdate": "2020-03-25",
          "solution": "Upgrade to versions 0.18.26, 0.20.20, 0.21.2 or above.",
          "title": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "urls": [
            "https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6",
            "https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec",
            "https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca",
            "https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b",
            "https://nvd.nist.gov/vuln/detail/CVE-2020-5280",
            "https://github.com/advisories/GHSA-66q9-f7ff-mmx6"
          ],
          "uuid": "4f2128cd-3066-403a-89e0-e99179a631e6"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.18.26",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.20.20",
                "versionStartIncluding": "0.19.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.21.2",
                "versionStartIncluding": "0.21.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-5280"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-22"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca",
              "refsource": "MISC",
              "tags": [
                "Patch"
              ],
              "url": "https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca"
            },
            {
              "name": "https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec",
              "refsource": "MISC",
              "tags": [
                "Patch"
              ],
              "url": "https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec"
            },
            {
              "name": "https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b",
              "refsource": "MISC",
              "tags": [
                "Patch"
              ],
              "url": "https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b"
            },
            {
              "name": "https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2020-03-30T17:48Z",
      "publishedDate": "2020-03-25T18:15Z"
    }
  }
}

fkie_cve-2020-5280

Vulnerability from fkie_nvd

Published

2020-03-25 18:15

Modified

2024-11-21 05:33

Severity ?

7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec	Patch
security-advisories@github.com	https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca	Patch
security-advisories@github.com	https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b	Patch
security-advisories@github.com	https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6	Third Party Advisory

Impacted products

Vendor	Product	Version
typelevel	http4s	*
typelevel	http4s	*
typelevel	http4s	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D8F27ABA-D902-4EFB-AA8A-1C1A3637517A",
              "versionEndExcluding": "0.18.26",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1B72AEE1-950A-4AB8-9620-A9E4DE39ACEB",
              "versionEndExcluding": "0.20.20",
              "versionStartIncluding": "0.19.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "15358AD5-7CD3-4EC2-B986-6115420D15D8",
              "versionEndExcluding": "0.21.2",
              "versionStartIncluding": "0.21.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported."
    },
    {
      "lang": "es",
      "value": "http4s versiones anteriores a 0.18.26, 0.20.20 y 0.21.2, presenta una vulnerabilidad de inclusi\u00f3n de archivos local. Esta vulnerabilidad se aplica a todos los usuarios de org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService y org.http4s.server.staticcontent.WebjarService. La normalizaci\u00f3n de URI es aplicada incorrectamente. Las peticiones cuya informaci\u00f3n de ruta contiene ../ o // pueden exponer recursos fuera de la ubicaci\u00f3n configurada. Este problema est\u00e1 parcheado en las versiones 0.18.26, 0.20.20 y 0.21.2. Tome en cuenta que la versi\u00f3n 0.19.0 es una versi\u00f3n en desuso y nunca ha sido compatible."
    }
  ],
  "id": "CVE-2020-5280",
  "lastModified": "2024-11-21T05:33:49.547",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-03-25T18:15:14.237",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-23"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

ghsa-66q9-f7ff-mmx6

Vulnerability from github

Published

2020-03-25 17:35

Modified

2021-01-14 17:48

Severity ?

7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Summary

Local file inclusion vulnerability in http4s

Details

Impact

This vulnerability applies to all users of: * org.http4s.server.staticcontent.FileService * org.http4s.server.staticcontent.ResourceService * org.http4s.server.staticcontent.WebjarService

Path escaping

URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. Specifically:

FileService may expose any file on the local file system.
ResourceService may expose any resource on the class path.

Prefix matching

When the service is configured with a non-empty pathPrefix that doesn't end in a slash, any directories whose names are a prefix of systemPath (from FileService) or pathPrefix (from ResourceService) are exposed. For example, if pathPrefix is /foo and systemPath is /bar, a request to /foobaz/quux.txt exposes file /barbaz/quux.txt, when only files beneath /bar should be available.

URI decoding

URI segments are not decoded before resource resolution. This causes resources with reserved characters in their name to incorrectly return a 404. It also may incorrectly expose the rare resource whose name is URI encoded. This applies to FileService, ResourceService, and WebjarService.

Patches

In all three services, paths with an empty segment, a . segment, or a .. segment are now rejected with a 400 Bad Request response. This fixes exposure outside the configured root. Many clients already eliminate dot segments according to the rules in RFC3986, Section 5.2.4. A middleware that does so at the server level may be considered if there is demand.

If pathInfo is non-empty, and does not begin with /, then a 404 response is generated. This fixes the prefix matching exposure.

All path segments are URI decoded before being passed to the file system or resource path. This allows resolution of resources with reserved characters in the name, and prevents incorrect exposure of resources whose names are themselves URI encoded.

Workarounds

The recommended course is to upgrade: * v0.18.26, binary compatible with the 0.18.x series * v0.20.20, binary compatible with the 0.20.x series * v0.21.2, binary compatible with the 0.21.x series

Note that 0.19.0 is a deprecated release and has never been supported.

If an upgrade is impossible:

Temporarily copy FileService.scala, ResourceService.scala, and WebjarService.scala from the appropriate release series into your project and recompile with that, changing the package name and reference in your application.
Users of a servlet backend can use the servlet container's file serving capabilities.

Credits

Thank you to Thomas Gøytil for the discovery, responsible disclosure, and assistance testing of this vulnerability.

For more information

If you have any questions or comments about this advisory: * Open an issue in http4s/http4s * Email a maintainer: * Ross A. Baker

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-server_2.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.18.26"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-server_2.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.19.0"
            },
            {
              "fixed": "0.20.20"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.http4s:http4s-server_2.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.21.0"
            },
            {
              "fixed": "0.21.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-5280"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-03-25T17:34:45Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nThis vulnerability applies to all users of:\n* `org.http4s.server.staticcontent.FileService`\n* `org.http4s.server.staticcontent.ResourceService`\n* `org.http4s.server.staticcontent.WebjarService`\n\n#### Path escaping\n\nURI normalization is applied incorrectly.  Requests whose path info contain `../` or `//` can expose resources outside of the configured location.  Specifically:\n\n* `FileService` may expose any file on the local file system.\n* `ResourceService` may expose any resource on the class path.\n\n#### Prefix matching\n\nWhen the service is configured with a non-empty `pathPrefix` that doesn\u0027t end in a slash, any directories whose names are a prefix of `systemPath` (from `FileService`) or `pathPrefix` (from `ResourceService`) are exposed.  For example, if `pathPrefix` is `/foo` and `systemPath` is `/bar`, a request to `/foobaz/quux.txt` exposes file `/barbaz/quux.txt`, when only files beneath `/bar` should be available.\n\n#### URI decoding\n\nURI segments are not decoded before resource resolution.  This causes resources with reserved characters in their name to incorrectly return a 404.  It also may incorrectly expose the rare resource whose name is URI encoded.  This applies to `FileService`, `ResourceService`, and `WebjarService`.\n\n### Patches\n\nIn all three services, paths with an empty segment, a `.` segment, or a `..` segment are now rejected with a `400 Bad Request` response.  This fixes exposure outside the configured root.  Many clients already eliminate dot segments according to the rules in [RFC3986, Section 5.2.4](https://tools.ietf.org/html/rfc3986#section-5.2.4).  A middleware that does so at the server level may be considered if there is demand.\n\nIf `pathInfo` is non-empty, and does not begin with `/`, then a 404 response is generated.  This fixes the prefix matching exposure.\n\nAll path segments are URI decoded before being passed to the file system or resource path.  This allows resolution of resources with reserved characters in the name, and prevents incorrect exposure of resources whose names are themselves URI encoded.\n\n### Workarounds\n\nThe recommended course is to upgrade:\n* v0.18.26, binary compatible with the 0.18.x series\n* v0.20.20, binary compatible with the 0.20.x series\n* v0.21.2, binary compatible with the 0.21.x series\n\nNote that 0.19.0 is a deprecated release and has never been supported.\n\nIf an upgrade is impossible:\n\n* Temporarily copy `FileService.scala`, `ResourceService.scala`, and `WebjarService.scala` from the appropriate release series into your project and recompile with that, changing the package name and reference in your application.\n* Users of a servlet backend can use the servlet container\u0027s file serving capabilities.\n\n### Credits\n\nThank you to Thomas G\u00f8ytil for the discovery, responsible disclosure, and assistance testing of this vulnerability.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [http4s/http4s](http://github.com/http4s/http4s)\n* Email a maintainer:\n  * [Ross A. Baker](mailto:ross@rossabaker.com)",
  "id": "GHSA-66q9-f7ff-mmx6",
  "modified": "2021-01-14T17:48:17Z",
  "published": "2020-03-25T17:35:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5280"
    },
    {
      "type": "WEB",
      "url": "https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec"
    },
    {
      "type": "WEB",
      "url": "https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca"
    },
    {
      "type": "WEB",
      "url": "https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Local file inclusion vulnerability in http4s"
}

cnvd-2020-35526

Vulnerability from cnvd

Title: http4s路径遍历漏洞

Description:

http4s是一款开源的用于Scala的流HTTP服务器。

http4s 0.18.26之前版本、0.20.20之前版本和0.21.2之前版本中的FileService、ResourceService和WebjarService存在路径遍历漏洞，该漏洞源于程序没有对URL进行正确的规范化处理。攻击者可利用该漏洞获取被限制的资源。

Severity: 中

Patch Name: http4s路径遍历漏洞的补丁

Patch Description:

http4s是一款开源的用于Scala的流HTTP服务器。

http4s 0.18.26之前版本、0.20.20之前版本和0.21.2之前版本中的FileService、ResourceService和WebjarService存在路径遍历漏洞，该漏洞源于程序没有对URL进行正确的规范化处理。攻击者可利用该漏洞获取被限制的资源。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商只发布了该软件0.18.26版本、0.20.20版本和0.21.2版本的修复措施，该软件0.19.0版本的修复措施暂未发布，详情请参考链接： https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6

Reference: https://nvd.nist.gov/vuln/detail/CVE-2020-5280

Impacted products

Name
['http4s http4s <0.18.26', 'http4s http4s <0.20.20', 'http4s http4s <0.21.2']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-5280"
    }
  },
  "description": "http4s\u662f\u4e00\u6b3e\u5f00\u6e90\u7684\u7528\u4e8eScala\u7684\u6d41HTTP\u670d\u52a1\u5668\u3002\n\nhttp4s 0.18.26\u4e4b\u524d\u7248\u672c\u30010.20.20\u4e4b\u524d\u7248\u672c\u548c0.21.2\u4e4b\u524d\u7248\u672c\u4e2d\u7684FileService\u3001ResourceService\u548cWebjarService\u5b58\u5728\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u6ca1\u6709\u5bf9URL\u8fdb\u884c\u6b63\u786e\u7684\u89c4\u8303\u5316\u5904\u7406\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u88ab\u9650\u5236\u7684\u8d44\u6e90\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u53ea\u53d1\u5e03\u4e86\u8be5\u8f6f\u4ef60.18.26\u7248\u672c\u30010.20.20\u7248\u672c\u548c0.21.2\u7248\u672c\u7684\u4fee\u590d\u63aa\u65bd\uff0c\u8be5\u8f6f\u4ef60.19.0\u7248\u672c\u7684\u4fee\u590d\u63aa\u65bd\u6682\u672a\u53d1\u5e03\uff0c\u8be6\u60c5\u8bf7\u53c2\u8003\u94fe\u63a5\uff1a\r\nhttps://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-35526",
  "openTime": "2020-07-01",
  "patchDescription": "http4s\u662f\u4e00\u6b3e\u5f00\u6e90\u7684\u7528\u4e8eScala\u7684\u6d41HTTP\u670d\u52a1\u5668\u3002\r\n\r\nhttp4s 0.18.26\u4e4b\u524d\u7248\u672c\u30010.20.20\u4e4b\u524d\u7248\u672c\u548c0.21.2\u4e4b\u524d\u7248\u672c\u4e2d\u7684FileService\u3001ResourceService\u548cWebjarService\u5b58\u5728\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u6ca1\u6709\u5bf9URL\u8fdb\u884c\u6b63\u786e\u7684\u89c4\u8303\u5316\u5904\u7406\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u88ab\u9650\u5236\u7684\u8d44\u6e90\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "http4s\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "http4s http4s \u003c0.18.26",
      "http4s http4s \u003c0.20.20",
      "http4s http4s \u003c0.21.2"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-5280",
  "serverity": "\u4e2d",
  "submitTime": "2020-03-26",
  "title": "http4s\u8def\u5f84\u904d\u5386\u6f0f\u6d1e"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2020-5280 (GCVE-0-2020-5280)

Vulnerability from cvelistv5

gsd-2020-5280

Vulnerability from gsd

fkie_cve-2020-5280

Vulnerability from fkie_nvd

ghsa-66q9-f7ff-mmx6

Vulnerability from github

Impact

Path escaping

Prefix matching

URI decoding

Patches

Workarounds

Credits

For more information

cnvd-2020-35526

Vulnerability from cnvd

Tags

Sightings

Nomenclature