Skip to content
CVE PROGRAM SOURCE RECORD2.4 Low

CVE-2024-45687

HTTP Server incorrectly accepting disallowed characters within header values

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Payara

Description

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Management Interface modules), Payara Platform Payara Micro (Grizzly modules) allows Manipulating State, Identity Spoofing.This issue affects Payara Server: from 4.1.151 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0; Payara Micro: from 4.1.152 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Payara Platform Payara Server

Default version status: unaffected

  • 4.1.151 to ≤ 4.1.2.191.51affected
  • 5.20.0 to ≤ 5.70.0affected
  • 5.2020.2 to ≤ 5.2022.5affected
  • 6.2022.1 to ≤ 6.2024.12affected
  • 6.0.0 to ≤ 6.21.0affected

Payara Platform Payara Micro

Default version status: unaffected

  • 4.1.152 to ≤ 4.1.2.191.51affected
  • 5.20.0 to ≤ 5.70.0affected
  • 5.2020.2 to ≤ 5.2022.5affected
  • 6.2022.1 to ≤ 6.2024.12affected
  • 6.0.0 to ≤ 6.21.0affected

References