What is GHSA-pp3c-cf6j-m3ff?

GHSA-pp3c-cf6j-m3ff is a security advisory published by GitHub Security Advisories with High severity. Server-Side Request Forgery in Jodd HTTP

Which CVE IDs does GHSA-pp3c-cf6j-m3ff cover?

GHSA-pp3c-cf6j-m3ff covers the following CVE IDs: CVE-2022-29631. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pp3c-cf6j-m3ff?

GHSA-pp3c-cf6j-m3ff has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-pp3c-cf6j-m3ff?

GHSA-pp3c-cf6j-m3ff affects 1 product, including: maven/org.jodd:jodd-http:\u003e= 5.0.0, \u003c 6.2.1.

GHSA-pp3c-cf6j-m3ffHighCVSS 7.5

Server-Side Request Forgery in Jodd HTTP

Vendor

GitHub Security Advisories

Published

June 7, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-29631 →

📋 Description

Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers to execute Server-Side Request Forgery (SSRF) via a crafted TCP payload.

🎯 Affected products1

maven/org.jodd:jodd-http:>= 5.0.0, < 6.2.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2022-29631
https://github.com/oblac/jodd-http/issues/9
https://github.com/oblac/jodd/issues/787
https://github.com/oblac/jodd-http/commit/e50f573c8f6a39212ade68c6eb1256b2889fa8a6
https://github.com/advisories/GHSA-pp3c-cf6j-m3ff