Description

The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400.

Remediation

References

CVE-2020-1710

Related Vulnerabilities

Dolibarr Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-13239)

WordPress Improper Input Validation Vulnerability (CVE-2020-26596)

Joomla Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2011-1151)

Roundcube Cross-site Scripting (XSS) Vulnerability (CVE-2015-8105)

Lodash CVE-2018-16487 Vulnerability (CVE-2018-16487)

Severity

Medium

Classification

CVE-2020-1710 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities