nginx up to 1.18.0 HTTP Request request smuggling

Summaryinfo

A vulnerability categorized as critical has been discovered in nginx up to 1.18.0. The affected element is an unknown function. Such manipulation as part of HTTP Request leads to request smuggling. This vulnerability is uniquely identified as CVE-2020-12440. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in nginx up to 1.18.0 (Web Server) and classified as critical. Affected by this issue is an unknown functionality. The manipulation as part of a HTTP Request leads to a request smuggling vulnerability. Using CWE to declare the problem leads to CWE-444. The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. Impacted is confidentiality, integrity, and availability. CVE summarizes:

NGINX through 1.18.0 allows an HTTP request smuggling attack that can lead to cache poisoning, credential hijacking, or security bypass.

The weakness was disclosed 05/14/2020. This vulnerability is handled as CVE-2020-12440 since 04/28/2020. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Web Server

Name

• nginx

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion