CVE-2013-4366

http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.

Published: Oct 30, 2017
Updated: May 9, 2024
CVE: CVE-2013-4366
GHSA: GHSA-pqwh-44jj-p5rm
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

CWE-20

Affected Software
References

Software	From	Fixed in
apache / httpclient	4.3-beta1	4.3-beta1.x
apache / httpclient	4.3	4.3.x
apache / httpclient	4.3-beta2	4.3-beta2.x
apache / httpclient	4.3-alpha1	4.3-alpha1.x
org.apache.httpcomponents / httpclient	4.3	4.3.1

http://svn.apache.org/r1528614
http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.3.x.txt

Vulnerability Database

CVE-2013-4366

Deep Security Visibility Without the Complexity