CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2020-5280

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.008

EPSS Ranking 73.9%

CVSS Severity

CVSS v3 Score 7.6

CVSS v2 Score 5.0

References

Products affected by CVE-2020-5280

Typelevel » Http4s » Version: 0.1.0

cpe:2.3:a:typelevel:http4s:0.1.0
Typelevel » Http4s » Version: 0.1.1

cpe:2.3:a:typelevel:http4s:0.1.1
Typelevel » Http4s » Version: 0.10.0

cpe:2.3:a:typelevel:http4s:0.10.0
Typelevel » Http4s » Version: 0.10.1

cpe:2.3:a:typelevel:http4s:0.10.1
Typelevel » Http4s » Version: 0.11.0

cpe:2.3:a:typelevel:http4s:0.11.0
Typelevel » Http4s » Version: 0.11.1

cpe:2.3:a:typelevel:http4s:0.11.1
Typelevel » Http4s » Version: 0.11.2

cpe:2.3:a:typelevel:http4s:0.11.2
Typelevel » Http4s » Version: 0.11.3

cpe:2.3:a:typelevel:http4s:0.11.3
Typelevel » Http4s » Version: 0.12.0

cpe:2.3:a:typelevel:http4s:0.12.0
Typelevel » Http4s » Version: 0.12.1

cpe:2.3:a:typelevel:http4s:0.12.1
Typelevel » Http4s » Version: 0.12.2

cpe:2.3:a:typelevel:http4s:0.12.2
Typelevel » Http4s » Version: 0.12.3

cpe:2.3:a:typelevel:http4s:0.12.3
Typelevel » Http4s » Version: 0.12.4

cpe:2.3:a:typelevel:http4s:0.12.4
Typelevel » Http4s » Version: 0.12.5

cpe:2.3:a:typelevel:http4s:0.12.5
Typelevel » Http4s » Version: 0.12.6

cpe:2.3:a:typelevel:http4s:0.12.6
Typelevel » Http4s » Version: 0.13.0

cpe:2.3:a:typelevel:http4s:0.13.0
Typelevel » Http4s » Version: 0.13.1

cpe:2.3:a:typelevel:http4s:0.13.1
Typelevel » Http4s » Version: 0.13.2

cpe:2.3:a:typelevel:http4s:0.13.2
Typelevel » Http4s » Version: 0.13.3

cpe:2.3:a:typelevel:http4s:0.13.3
Typelevel » Http4s » Version: 0.14.0

cpe:2.3:a:typelevel:http4s:0.14.0
Typelevel » Http4s » Version: 0.14.1

cpe:2.3:a:typelevel:http4s:0.14.1
Typelevel » Http4s » Version: 0.14.10

cpe:2.3:a:typelevel:http4s:0.14.10
Typelevel » Http4s » Version: 0.14.11

cpe:2.3:a:typelevel:http4s:0.14.11
Typelevel » Http4s » Version: 0.14.2

cpe:2.3:a:typelevel:http4s:0.14.2
Typelevel » Http4s » Version: 0.14.3

cpe:2.3:a:typelevel:http4s:0.14.3
Typelevel » Http4s » Version: 0.14.4

cpe:2.3:a:typelevel:http4s:0.14.4
Typelevel » Http4s » Version: 0.14.5

cpe:2.3:a:typelevel:http4s:0.14.5
Typelevel » Http4s » Version: 0.14.6

cpe:2.3:a:typelevel:http4s:0.14.6
Typelevel » Http4s » Version: 0.14.7

cpe:2.3:a:typelevel:http4s:0.14.7
Typelevel » Http4s » Version: 0.14.8

cpe:2.3:a:typelevel:http4s:0.14.8
Typelevel » Http4s » Version: 0.14.9

cpe:2.3:a:typelevel:http4s:0.14.9
Typelevel » Http4s » Version: 0.15.0

cpe:2.3:a:typelevel:http4s:0.15.0
Typelevel » Http4s » Version: 0.15.1

cpe:2.3:a:typelevel:http4s:0.15.1
Typelevel » Http4s » Version: 0.15.10

cpe:2.3:a:typelevel:http4s:0.15.10
Typelevel » Http4s » Version: 0.15.11

cpe:2.3:a:typelevel:http4s:0.15.11
Typelevel » Http4s » Version: 0.15.12

cpe:2.3:a:typelevel:http4s:0.15.12
Typelevel » Http4s » Version: 0.15.13

cpe:2.3:a:typelevel:http4s:0.15.13
Typelevel » Http4s » Version: 0.15.14

cpe:2.3:a:typelevel:http4s:0.15.14
Typelevel » Http4s » Version: 0.15.15

cpe:2.3:a:typelevel:http4s:0.15.15
Typelevel » Http4s » Version: 0.15.16

cpe:2.3:a:typelevel:http4s:0.15.16
Typelevel » Http4s » Version: 0.15.2

cpe:2.3:a:typelevel:http4s:0.15.2
Typelevel » Http4s » Version: 0.15.3

cpe:2.3:a:typelevel:http4s:0.15.3
Typelevel » Http4s » Version: 0.15.4

cpe:2.3:a:typelevel:http4s:0.15.4
Typelevel » Http4s » Version: 0.15.5

cpe:2.3:a:typelevel:http4s:0.15.5
Typelevel » Http4s » Version: 0.15.6

cpe:2.3:a:typelevel:http4s:0.15.6
Typelevel » Http4s » Version: 0.15.7

cpe:2.3:a:typelevel:http4s:0.15.7
Typelevel » Http4s » Version: 0.15.8

cpe:2.3:a:typelevel:http4s:0.15.8
Typelevel » Http4s » Version: 0.15.9

cpe:2.3:a:typelevel:http4s:0.15.9
Typelevel » Http4s » Version: 0.16.0

cpe:2.3:a:typelevel:http4s:0.16.0
Typelevel » Http4s » Version: 0.16.1

cpe:2.3:a:typelevel:http4s:0.16.1
Typelevel » Http4s » Version: 0.16.2

cpe:2.3:a:typelevel:http4s:0.16.2
Typelevel » Http4s » Version: 0.16.3

cpe:2.3:a:typelevel:http4s:0.16.3
Typelevel » Http4s » Version: 0.16.4

cpe:2.3:a:typelevel:http4s:0.16.4
Typelevel » Http4s » Version: 0.16.5

cpe:2.3:a:typelevel:http4s:0.16.5
Typelevel » Http4s » Version: 0.16.6

cpe:2.3:a:typelevel:http4s:0.16.6
Typelevel » Http4s » Version: 0.17.0

cpe:2.3:a:typelevel:http4s:0.17.0
Typelevel » Http4s » Version: 0.17.1

cpe:2.3:a:typelevel:http4s:0.17.1
Typelevel » Http4s » Version: 0.17.2

cpe:2.3:a:typelevel:http4s:0.17.2
Typelevel » Http4s » Version: 0.17.3

cpe:2.3:a:typelevel:http4s:0.17.3
Typelevel » Http4s » Version: 0.17.4

cpe:2.3:a:typelevel:http4s:0.17.4
Typelevel » Http4s » Version: 0.17.5

cpe:2.3:a:typelevel:http4s:0.17.5
Typelevel » Http4s » Version: 0.17.6

cpe:2.3:a:typelevel:http4s:0.17.6
Typelevel » Http4s » Version: 0.18.0

cpe:2.3:a:typelevel:http4s:0.18.0
Typelevel » Http4s » Version: 0.18.1

cpe:2.3:a:typelevel:http4s:0.18.1
Typelevel » Http4s » Version: 0.18.10

cpe:2.3:a:typelevel:http4s:0.18.10
Typelevel » Http4s » Version: 0.18.11

cpe:2.3:a:typelevel:http4s:0.18.11
Typelevel » Http4s » Version: 0.18.12

cpe:2.3:a:typelevel:http4s:0.18.12
Typelevel » Http4s » Version: 0.18.13

cpe:2.3:a:typelevel:http4s:0.18.13
Typelevel » Http4s » Version: 0.18.14

cpe:2.3:a:typelevel:http4s:0.18.14
Typelevel » Http4s » Version: 0.18.15

cpe:2.3:a:typelevel:http4s:0.18.15
Typelevel » Http4s » Version: 0.18.16

cpe:2.3:a:typelevel:http4s:0.18.16
Typelevel » Http4s » Version: 0.18.17

cpe:2.3:a:typelevel:http4s:0.18.17
Typelevel » Http4s » Version: 0.18.18

cpe:2.3:a:typelevel:http4s:0.18.18
Typelevel » Http4s » Version: 0.18.19

cpe:2.3:a:typelevel:http4s:0.18.19
Typelevel » Http4s » Version: 0.18.2

cpe:2.3:a:typelevel:http4s:0.18.2
Typelevel » Http4s » Version: 0.18.20

cpe:2.3:a:typelevel:http4s:0.18.20
Typelevel » Http4s » Version: 0.18.21

cpe:2.3:a:typelevel:http4s:0.18.21
Typelevel » Http4s » Version: 0.18.22

cpe:2.3:a:typelevel:http4s:0.18.22
Typelevel » Http4s » Version: 0.18.23

cpe:2.3:a:typelevel:http4s:0.18.23
Typelevel » Http4s » Version: 0.18.24

cpe:2.3:a:typelevel:http4s:0.18.24
Typelevel » Http4s » Version: 0.18.25

cpe:2.3:a:typelevel:http4s:0.18.25
Typelevel » Http4s » Version: 0.18.3

cpe:2.3:a:typelevel:http4s:0.18.3
Typelevel » Http4s » Version: 0.18.4

cpe:2.3:a:typelevel:http4s:0.18.4
Typelevel » Http4s » Version: 0.18.5

cpe:2.3:a:typelevel:http4s:0.18.5
Typelevel » Http4s » Version: 0.18.6

cpe:2.3:a:typelevel:http4s:0.18.6
Typelevel » Http4s » Version: 0.18.7

cpe:2.3:a:typelevel:http4s:0.18.7
Typelevel » Http4s » Version: 0.18.8

cpe:2.3:a:typelevel:http4s:0.18.8
Typelevel » Http4s » Version: 0.18.9

cpe:2.3:a:typelevel:http4s:0.18.9
Typelevel » Http4s » Version: 0.19.0

cpe:2.3:a:typelevel:http4s:0.19.0
Typelevel » Http4s » Version: 0.2.0

cpe:2.3:a:typelevel:http4s:0.2.0
Typelevel » Http4s » Version: 0.20.0

cpe:2.3:a:typelevel:http4s:0.20.0
Typelevel » Http4s » Version: 0.20.1

cpe:2.3:a:typelevel:http4s:0.20.1
Typelevel » Http4s » Version: 0.20.10

cpe:2.3:a:typelevel:http4s:0.20.10
Typelevel » Http4s » Version: 0.20.11

cpe:2.3:a:typelevel:http4s:0.20.11
Typelevel » Http4s » Version: 0.20.12

cpe:2.3:a:typelevel:http4s:0.20.12
Typelevel » Http4s » Version: 0.20.13

cpe:2.3:a:typelevel:http4s:0.20.13
Typelevel » Http4s » Version: 0.20.14

cpe:2.3:a:typelevel:http4s:0.20.14
Typelevel » Http4s » Version: 0.20.15

cpe:2.3:a:typelevel:http4s:0.20.15
Typelevel » Http4s » Version: 0.20.16

cpe:2.3:a:typelevel:http4s:0.20.16
Typelevel » Http4s » Version: 0.20.17

cpe:2.3:a:typelevel:http4s:0.20.17
Typelevel » Http4s » Version: 0.20.18

cpe:2.3:a:typelevel:http4s:0.20.18
Typelevel » Http4s » Version: 0.20.19

cpe:2.3:a:typelevel:http4s:0.20.19
Typelevel » Http4s » Version: 0.20.2

cpe:2.3:a:typelevel:http4s:0.20.2
Typelevel » Http4s » Version: 0.20.3

cpe:2.3:a:typelevel:http4s:0.20.3
Typelevel » Http4s » Version: 0.20.4

cpe:2.3:a:typelevel:http4s:0.20.4
Typelevel » Http4s » Version: 0.20.6

cpe:2.3:a:typelevel:http4s:0.20.6
Typelevel » Http4s » Version: 0.20.7

cpe:2.3:a:typelevel:http4s:0.20.7
Typelevel » Http4s » Version: 0.20.8

cpe:2.3:a:typelevel:http4s:0.20.8
Typelevel » Http4s » Version: 0.20.9

cpe:2.3:a:typelevel:http4s:0.20.9
Typelevel » Http4s » Version: 0.21.0

cpe:2.3:a:typelevel:http4s:0.21.0
Typelevel » Http4s » Version: 0.21.1

cpe:2.3:a:typelevel:http4s:0.21.1
Typelevel » Http4s » Version: 0.3.0

cpe:2.3:a:typelevel:http4s:0.3.0
Typelevel » Http4s » Version: 0.4.0

cpe:2.3:a:typelevel:http4s:0.4.0
Typelevel » Http4s » Version: 0.4.1

cpe:2.3:a:typelevel:http4s:0.4.1
Typelevel » Http4s » Version: 0.4.2

cpe:2.3:a:typelevel:http4s:0.4.2
Typelevel » Http4s » Version: 0.5.0

cpe:2.3:a:typelevel:http4s:0.5.0
Typelevel » Http4s » Version: 0.5.1

cpe:2.3:a:typelevel:http4s:0.5.1
Typelevel » Http4s » Version: 0.5.2

cpe:2.3:a:typelevel:http4s:0.5.2
Typelevel » Http4s » Version: 0.5.3

cpe:2.3:a:typelevel:http4s:0.5.3
Typelevel » Http4s » Version: 0.5.4

cpe:2.3:a:typelevel:http4s:0.5.4
Typelevel » Http4s » Version: 0.6.0

cpe:2.3:a:typelevel:http4s:0.6.0
Typelevel » Http4s » Version: 0.6.1

cpe:2.3:a:typelevel:http4s:0.6.1
Typelevel » Http4s » Version: 0.6.2

cpe:2.3:a:typelevel:http4s:0.6.2
Typelevel » Http4s » Version: 0.6.3

cpe:2.3:a:typelevel:http4s:0.6.3
Typelevel » Http4s » Version: 0.6.4

cpe:2.3:a:typelevel:http4s:0.6.4
Typelevel » Http4s » Version: 0.6.5

cpe:2.3:a:typelevel:http4s:0.6.5
Typelevel » Http4s » Version: 0.7.0

cpe:2.3:a:typelevel:http4s:0.7.0
Typelevel » Http4s » Version: 0.8.0

cpe:2.3:a:typelevel:http4s:0.8.0
Typelevel » Http4s » Version: 0.8.1

cpe:2.3:a:typelevel:http4s:0.8.1
Typelevel » Http4s » Version: 0.8.2

cpe:2.3:a:typelevel:http4s:0.8.2
Typelevel » Http4s » Version: 0.8.3

cpe:2.3:a:typelevel:http4s:0.8.3
Typelevel » Http4s » Version: 0.8.4

cpe:2.3:a:typelevel:http4s:0.8.4
Typelevel » Http4s » Version: 0.8.5

cpe:2.3:a:typelevel:http4s:0.8.5
Typelevel » Http4s » Version: 0.8.6

cpe:2.3:a:typelevel:http4s:0.8.6
Typelevel » Http4s » Version: 0.9.0

cpe:2.3:a:typelevel:http4s:0.9.0
Typelevel » Http4s » Version: 0.9.1

cpe:2.3:a:typelevel:http4s:0.9.1
Typelevel » Http4s » Version: 0.9.2

cpe:2.3:a:typelevel:http4s:0.9.2
Typelevel » Http4s » Version: 0.9.3

cpe:2.3:a:typelevel:http4s:0.9.3

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2020-5280

Products

Pricing

Contact Us