HTTP Request Smuggling

Affecting org.jboss.resteasy:resteasy-jaxrs artifact, versions [3.1.0.Beta1,3.5.0.CR1) || [,3.0.25.Final)

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

org.jboss.resteasy:resteasy-jaxrs is a JCP specification that provides a Java API for RESTful Web Services over the HTTP protocol.

Affected versions of this package are vulnerable to HTTP Request Smuggling. It was discovered that the CORS Filter did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.

Remediation

Upgrade org.jboss.resteasy:resteasy-jaxrs to version 3.5.0.CR1, 3.0.25.Final or higher.

References

CVSS Score

7.5
high severity
  • Attack Vector
    Network
  • Attack Complexity
    Low
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    None
  • Integrity
    High
  • Availability
    None
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Credit
Jason Shepherd
CVE
CVE-2017-7561
CWE
CWE-444
Snyk ID
SNYK-JAVA-ORGJBOSSRESTEASY-542664
Disclosed
22 Aug, 2017
Published
19 Jan, 2020