Vulnerability Database

289,697

Total vulnerabilities in the database

CVE-2020-15049

An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing "+\ "-" or an uncommon shell whitespace character prefix to the length field-value.

  • Published: Jun 30, 2020
  • Updated: Apr 13, 2023
  • CVE: CVE-2020-15049
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 8.8
  • AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: Medium
  • Score: 6.5
  • AV:N/AC:L/Au:S/C:P/I:P/A:P

CWEs:

Software From Fixed in
squid-cache / squid 2.7-stable3 2.7-stable3.x
squid-cache / squid 2.7-stable4 2.7-stable4.x
squid-cache / squid 2.7 2.7.x
squid-cache / squid 2.7-stable2 2.7-stable2.x
squid-cache / squid 2.7-stable5 2.7-stable5.x
squid-cache / squid 2.7-stable6 2.7-stable6.x
squid-cache / squid 2.7-stable7 2.7-stable7.x
squid-cache / squid 2.7-stable8 2.7-stable8.x
squid-cache / squid 2.7-stable9 2.7-stable9.x
squid-cache / squid 4.0 4.12
squid-cache / squid 3.1 3.5.28.x
squid-cache / squid 2.0 2.6.x
squid-cache / squid 5.0 5.0.3
fedoraproject / fedora 31 31.x