Description

An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API.

Remediation

References

CVE-2020-11724

Related Vulnerabilities

Craft CMS Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2020-9757)

WordPress Plugin Gallery Master-Responsive Photo Galleries & Albums Cross-Site Scripting (1.0.22)

WordPress Plugin Login/Signup Popup (Inline Form + Woocommerce) Cross-Site Scripting (1.4)

Envoy Proxy Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2023-27492)

PHP Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2011-3379)

Severity

High

Classification

CVE-2020-11724 CWE-444 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities