CVE-2020-7622

HTTP Response Splitting

Medium · published April 6, 2020

CVSS v3.1
6.5
EPSS
2%
Percentile
75.6
In the wild
Unconfirmed
What it is

This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01602 · 75.6th percentile
Published
2020-04-06T14:08Z
EPSS history
Timeline
  • 06 APR 14:08Z
    HTTP Response Splitting
    cvelistv5