CVE Feed

    Dashboard / CVE / CVE-2020-5280

    CVE-2020-5280

    http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.

    Published:Mar 25, 2020
    Last Modified:Nov 21, 2024
    EPS:Mar 25, 2020
    EPSS Score:0.00848
    CVSS Score:7.6

    Affected Products

    Vendor
    Typelevel
    Product
    Http4s

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-59822 (CVSS 6.3) — Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.3…
    CVE-2023-22465 (CVSS 7.5) — Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22…
    CVE-2021-41084 (CVSS 8.7) — http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-split…
    CVE-2021-39185 (CVSS 9.1) — Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0…
    CVE-2021-32643 (CVSS 5.8) — Http4s is a Scala interface for HTTP services. `StaticFile.fromUrl` can leak the presence of a directory on a …
    CVE-2021-21294 (CVSS 7.5) — Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High