Log in Start free

Vulnerability · Published Jan 21, 2025 · Assigned by Payara

CVE-2024-45687HTTP Server incorrectly accepting disallowed characters within header values

Low 2.4

In plain English

A low-severity security flaw in Payara Micro from Payara Platform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 4.0)2.4Low
Exploit odds (30 days)0.2%top 85.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Management Interface modules), Payara Platform Payara Micro (Grizzly modules) allows Manipulating State, Identity Spoofing.This issue affects Payara Server: from 4.1.151 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0; Payara Micro: from 4.1.152 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0.

Affected products (as reported)

VendorProductVersions
Payara Platform Payara Server 4.1.151 – through 4.1.2.191.515.20.0 – through 5.70.05.2020.2 – through 5.2022.56.2022.1 – through 6.2024.126.0.0 – through 6.21.0
Payara Platform Payara Micro 4.1.152 – through 4.1.2.191.515.20.0 – through 5.70.05.2020.2 – through 5.2022.56.2022.1 – through 6.2024.126.0.0 – through 6.21.0

Weakness: CWE-113 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N

References