Lucene search

GitHub Advisory DatabaseGHSA-XFV3-RRFM-F2RV

HistoryJun 30, 2020 - 9:01 p.m.

Information Exposure in Netty

2020-06-3021:01:21

CWE-20

GitHub Advisory Database

github.com

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.006

Percentile

77.8%

JSON

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.

Affected configurations

Vulners

Node

io.nettynettyRange<3.9.8.Final

io.nettynettyRange3.10.0–3.10.3.Final

org.jboss.nettynettyRange3.10.0–3.10.3.Final

org.jboss.nettynettyRange<3.9.8.Final

io.nettynetty-parentRange4.0.0–4.0.28.Final

VendorProductVersionCPE
io.nettynetty*cpe:2.3:a:io.netty:netty:*:*:*:*:*:*:*:*
org.jboss.nettynetty*cpe:2.3:a:org.jboss.netty:netty:*:*:*:*:*:*:*:*
io.nettynetty-parent*cpe:2.3:a:io.netty:netty-parent:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
io.netty	netty	*	cpe:2.3:a:io.netty:netty::::::::
org.jboss.netty	netty	*	cpe:2.3:a:org.jboss.netty:netty::::::::
io.netty	netty-parent	*	cpe:2.3:a:io.netty:netty-parent::::::::