CVE-2020-1710

Published: Sep 16, 2020Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400.

Products: Redhat: Jboss Data Grid, Jboss Enterprise Application Platform, Openshift Application Runtimes, Single Sign On

4 products

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Data Grid	All versions
Redhat Jboss Data Grid	Version 7.0.0
Redhat Jboss Enterprise Application Platform	All versions
Redhat Jboss Enterprise Application Platform	Version 6.4.21
Redhat Jboss Enterprise Application Platform	Version 7.0.0
Redhat Jboss Enterprise Application Platform	Version 7.2.0
Redhat Jboss Enterprise Application Platform	Version 7.3.0
Redhat Openshift Application Runtimes	All versions
Redhat Single Sign On	All versions

Source: secalert@redhat.com

Issue TrackingVendor Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

No history available yet.