Description

Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers to execute Server-Side Request Forgery (SSRF) via a crafted TCP payload.

Remediation

References

https://github.com/oblac/jodd/issues/787

https://github.com/oblac/jodd-http/issues/9

Related Vulnerabilities

CVE-2020-10689 Vulnerability in maven package org.eclipse.che.infrastructure:infrastructure-kubernetes

CVE-2019-18798 Vulnerability in maven package org.webjars.npm:node-sass

CVE-2022-29770 Vulnerability in maven package com.xuxueli:xxl-job

CVE-2022-4244 Vulnerability in maven package org.codehaus.plexus:plexus-utils

CVE-2021-31812 Vulnerability in maven package org.apache.pdfbox:pdfbox

Severity

High

Classification

CWE-74 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Exploit Issue Tracking Third Party Advisory