Description

In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.

Remediation

References

CVE-2020-10109

Related Vulnerabilities

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-14320)

WordPress Plugin WP Forum Server 'edit_post_id' Parameter SQL Injection (1.7)

WordPress 5.7.x Multiple Vulnerabilities (5.7 - 5.7.9)

Drupal 7PK - Security Features Vulnerability (CVE-2016-3163)

Atlassian Jira CVE-2020-14165 Vulnerability (CVE-2020-14165)

Severity

Critical

Classification

CVE-2020-10109 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities