Vulnerability · Published Feb 23, 2021 · Assigned by mitre
CVE-2020-13697
Medium 6.1
In plain English
A medium-severity security flaw in the org.nanohttpd:nanohttpd-nanolets package (Maven). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)0.8%top 44.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to reflected XSS, because the GeneralHandler GET handler prints user input passed through the query string without any sanitization.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.nanohttpd:nanohttpd-nanolets | no fix listed | GHSA-pr5m-4w22-8483 |
Affected products (as reported)
References
- https://github.com/NanoHttpd/nanohttpd x_refsource_MISC
- https://www.vdoo.com/advisories x_refsource_MISC