CVE-2020-5280highCWE-23

CVE-2020-5280: fallo de gravedad alta en http4s

Local file inclusion vulnerability in http4s

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear http4s+ Monitorear org.http4s:http4s-server_2.12

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.6epss 7.0%
http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Productos afectados
http4s · http4s
CVEs relacionadas — http4s

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-21294HIGHUnbounded connection acceptance in http4s-blaze-serverEPSS 2.2%CVE-2021-32643MEDIUMStaticFile.fromUrl can leak presence of a directoryEPSS 1.4%CVE-2021-41084HIGHResponse Splitting from unsanitized headers in http4sEPSS 1.2%CVE-2023-22465HIGHHttp4s has fatal error parsing User-Agent and Server headersEPSS 0.9%CVE-2026-69208HIGHHttp4s: DigestAuth nonce map grows unboundedEPSS 0.8%CVE-2026-69201MEDIUMHttp4s: ResourceService and Webjar Service path escape via percent-encoded separatorsEPSS 0.8%