What’s Vulnerable › Vulnerabilities
CVE-2020-13956
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 9.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-12-02 · updated 2026-10-08
- Weakness: CWE-20
Description
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
Affected products
- Apache Software Foundation Apache HttpClient: before 4.5.13; from 5.0.0 before 5.0.3 — fixed in 4.5.13, 5.0.3
- Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
- NetApp SnapCenter: all versions
- Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager: 11.3.2
- Oracle Communications Cloud Native Core Service Communication Proxy: 1.14.0
- Oracle Corporation Oracle Data Integrator: 12.2.1.3.0, 12.2.1.4.0
- Oracle Corporation JD Edwards EnterpriseOne Orchestrator: before 9.2.6.0 — fixed in 9.2.6.0
- Oracle Corporation JD Edwards EnterpriseOne Tools: before 9.2.6.0 — fixed in 9.2.6.0
- Oracle Nosql Database: before 20.3 — fixed in 20.3
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.57, 8.58
- Oracle Peoplesoft Enterprise Pt Peopletools: 8.57, 8.58, 8.59
- Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 16.1, 16.2, 18.8, 19.12, 20.12
- Oracle Corporation Retail Customer Management and Segmentation Foundation: from 16.0 through 19.0
- Oracle Spatial Studio: before 20.1.1 — fixed in 20.1.1
- Oracle Corporation SQL Developer: before 20.4.1.407.0006; before 21.99 — fixed in 20.4.1.407.0006, 21.99
- Oracle WebLogic Server: 12.2.1.4.0, 14.1.1.0.0
- quarkusio quarkus: before 1.7.6 — fixed in 1.7.6
How to fix
Upgrade to a fixed version: Apache Software Foundation Apache HttpClient 4.5.13, 5.0.3; Oracle Corporation JD Edwards EnterpriseOne Orchestrator 9.2.6.0; Oracle Corporation JD Edwards EnterpriseOne Tools 9.2.6.0; Oracle Nosql Database 20.3; Oracle Spatial Studio 20.1.1; Oracle Corporation SQL Developer 20.4.1.407.0006, 21.99; quarkusio quarkus 1.7.6. Check the vendor advisory for mitigations.
References
- https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749%40%3Cissues.maven.apache.org%3E
- https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9%40%3Cdev.hive.apache.org%3E
- https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb%40%3Cissues.drill.apache.org%3E
- https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1%40%3Cissues.solr.apache.org%3E
- https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe%40%3Cissues.solr.apache.org%3E
- https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0%40%3Cdev.ranger.apache.org%3E
- https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457%40%3Cdev.creadur.apache.org%3E
- https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3%40%3Cissues.lucene.apache.org%3E
- https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d%40%3Ccommits.creadur.apache.org%3E
- https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303%40%3Cgitbox.hive.apache.org%3E
- https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d%40%3Cdev.ranger.apache.org%3E
- https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707%40%3Ccommits.creadur.apache.org%3E
Get alerted when CVE-2020-13956 or the next vulnerability affects your stack