Attacker Value
Unknown
CVE-2020-27218
CVE-2020-27218
(Last updated February 17, 2024) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
4.8 Medium
Impact Score:
2.5
Exploitability Score:
2.2
Attack Vector (AV):
Network
Attack Complexity (AC):
High
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
None
Integrity (I):
Low
Availability (A):
Low
General Information
Products
- blockchain platform
- communications converged application server service controller 6.2
- communications offline mediation controller 12.0.0.3.0
- communications pricing design center 12.0.0.3.0
- communications services gatekeeper 7.0
- communications session route manager
- debian linux 10.0
- flexcube private banking 12.0.0
- flexcube private banking 12.1.0
- hyperion infrastructure technology 11.1.2.6.0
- jetty
- jetty 10.0.0
- jetty 11.0.0
- kafka 2.7.0
- oncommand system manager
- rest data services
- retail eftlink 20.0.0
- siebel core automation
- snap creator framework
- spark 2.4.8
- spark 3.0.3
References
Advisory
Miscellaneous
