Attacker Value
Unknown
CVE-2020-27223
CVE-2020-27223
(Last updated November 08, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
5.3 Medium
Impact Score:
1.4
Exploitability Score:
3.9
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
None
Integrity (I):
None
Availability (A):
Low
General Information
Vendors
- apache,
- debian,
- eclipse,
- netapp,
- oracle
Products
- debian linux 10.0,
- e-series santricity os controller,
- e-series santricity web services -,
- element plug-in for vcenter server -,
- hci -,
- hci management node -,
- jetty,
- jetty 10.0.0,
- jetty 11.0.0,
- jetty 9.4.36,
- jetty 9.4.6,
- management services for element software -,
- nifi 1.13.0,
- rest data services,
- snap creator framework -,
- snapcenter -,
- snapmanager -,
- solidfire -,
- solr 8.8.1,
- spark 3.1.1
References
Advisory
Miscellaneous
