Description

Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers to execute Server-Side Request Forgery (SSRF) via a crafted TCP payload.

Remediation

References

https://github.com/oblac/jodd-http/issues/9

https://github.com/oblac/jodd/issues/787

Related Vulnerabilities

CVE-2021-33587 Vulnerability in npm package css-what

CVE-2023-25345 Vulnerability in maven package org.webjars.npm:swig

CVE-2019-5427 Vulnerability in maven package com.mchange:c3p0

CVE-2023-22578 Vulnerability in npm package sequelize

CVE-2017-17068 Vulnerability in npm package auth0-js

Severity

High

Classification

CWE-74 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Exploit Issue Tracking Third Party Advisory