CVE-2020-13956
MediumAdvisory
Published 3 Jun 2021In the index since 6 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.090
- 95th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 190
- of 17,781 indexed, latest versions
- Container images
- 217
- deployed by those charts
- Fix available
- 28 of 28
- affected packages
Cross-site scripting in Apache HttpClient
Carried by container images the latest versions of 190 of 17,781 indexed charts deploy, on 217 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| httpclientmaven | 4.0.1, 4.0.2, 4.2.5, 4.2.6+19 more | 4.5.13 | 217 |
| aopalliancerpm | 1.0-20.module+el8.3.0+6804+157bd82e | 0:1.0-20.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-clirpm | 1.4-7.module+el8.3.0+6804+157bd82e | 0:1.4-7.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-codecrpm | 1.13-3.module+el8.3.0+6804+157bd82e | 0:1.13-3.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-iorpm | 1:2.6-6.module+el8.3.0+6804+157bd82e | 1:2.6-6.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-lang3rpm | 3.9-4.module+el8.3.0+6804+157bd82e | 0:3.9-4.module+el8.6.0+13337+afcb49ec | 5 |
| atinjectrpm | 1-31.20100611svn86.module+el8.3.0+6804+157bd82e | 0:1-31.20100611svn86.module+el8.6.0+13337+afcb49ec | 5 |
| cdi-apirpm | 2.0.1-3.module+el8.3.0+6804+157bd82e | 0:2.0.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| geronimo-annotationrpm | 1.0-26.module+el8.3.0+6804+157bd82e | 0:1.0-26.module+el8.6.0+13337+afcb49ec | 5 |
| google-guicerpm | 4.2.2-4.module+el8.3.0+6804+157bd82e | 0:4.2.2-4.module+el8.6.0+13337+afcb49ec | 5 |
| guavarpm | 28.1-3.module+el8.3.0+6804+157bd82e | 0:28.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| httpcomponents-clientrpm | 4.5.10-3.module+el8.3.0+6804+157bd82e | 0:4.5.10-4.module+el8.6.0+13337+afcb49ec | 5 |
| httpcomponents-corerpm | 4.4.12-3.module+el8.3.0+6804+157bd82e | 0:4.4.12-3.module+el8.6.0+13337+afcb49ec | 5 |
| jansirpm | 1.18-4.module+el8.3.0+6804+157bd82e | 0:1.18-4.module+el8.6.0+13337+afcb49ec | 5 |
| jsouprpm | 1.12.1-3.module+el8.3.0+6804+157bd82e | 0:1.12.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| jsr-305rpm | 0-0.25.20130910svn.module+el8.3.0+6804+157bd82e | 0:0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec | 5 |
| mavenrpm | 1:3.6.2-6.module+el8.4.0+9250+1786af37 | 1:3.6.2-7.module+el8.6.0+13337+afcb49ec | 5 |
| maven-resolverrpm | 1.4.1-3.module+el8.3.0+6804+157bd82e | 0:1.4.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| maven-shared-utilsrpm | 3.2.1-0.4.module+el8.3.0+6804+157bd82e | 0:3.2.1-0.4.module+el8.6.0+13337+afcb49ec | 5 |
| maven-wagonrpm | 3.3.4-2.module+el8.3.0+6804+157bd82e | 0:3.3.4-2.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-cipherrpm | 1.7-17.module+el8.3.0+6804+157bd82e | 0:1.7-17.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-classworldsrpm | 2.6.0-4.module+el8.3.0+6804+157bd82e | 0:2.6.0-4.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-containersrpm | 2.1.0-2.module+el8.3.0+6804+157bd82e | 0:2.1.0-2.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-interpolationrpm | 1.26-3.module+el8.3.0+6804+157bd82e | 0:1.26-3.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-sec-dispatcherrpm | 1.4-29.module+el8.3.0+6804+157bd82e | 0:1.4-29.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-utilsrpm | 3.3.0-3.module+el8.3.0+6804+157bd82e | 0:3.3.0-3.module+el8.6.0+13337+afcb49ec | 5 |
| sisurpm | 0.3.4-2.module+el8.3.0+6804+157bd82e | 0:0.3.4-2.module+el8.6.0+13337+afcb49ec | 5 |
| slf4jrpm | 1.7.28-3.module+el8.3.0+6804+157bd82e | 0:1.7.28-3.module+el8.6.0+13337+afcb49ec | 5 |
- OSV records
- GHSA-7r82-7xv7-xcpjRHSA-2022:1860
Charts affected
190 by stars
Container images carrying it
217 by charts deploying them
A fixed version is listed for 28 of the 28 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| confluentinc/ | f2975d507a2a | httpclient | 4.5.13 | 1 |
| confluentinc/ | 8f1544df1f48 | httpclient | 4.5.13 | 1 |
| confluentinc/ | 1bbda887bc53 | httpclient | 4.5.13 | 1 |
| confluentinc/ | c87b1c07fb53 | httpclient | 4.5.13 | 1 |
| confluentinc/ | 4bc70a83ca6f | httpclient | 4.5.13 | 1 |
| confluentinc/ | b0b7aa26254a | httpclient | 4.5.13 | 1 |
| confluentinc/ | ee403d5b9090 | httpclient | 4.5.13 | 1 |
| confluentinc/ | b651d4b6185a | httpclient | 4.5.13 | 1 |
| craigwillis/ | ae317d7e4724 | httpclient | 4.5.13 | 1 |
| datappeal/ | e38c085a3567 | httpclient | 4.5.13 | 1 |
| dbanda/ | 0ca125e68e53 | httpclient | 4.5.13 | 1 |
| dbanda/ | d0e6367876ae | httpclient | 4.5.13 | 1 |
| deltaio/ | 8b75118187c5 | httpclient | 4.5.13 | 1 |
| dniel/ | 45a667852f2a | httpclient | 4.5.13 | 1 |
| dniel/ | f67129ea1c64 | httpclient | 4.5.13 | 1 |
| dremio/ | 80ed2e3b7c43 | httpclient | 4.5.13 | 1 |
| drpcorg/ | 8858fae1859d | httpclient | 4.5.13 | 1 |
| egdsandaru/ | 681baa1926f4 | httpclient | 4.5.13 | 1 |
| emcniece/ | 04eccbccc15c | httpclient | 4.5.13 | 1 |
| emeraldpay/ | 126f0ae0b388 | httpclient | 4.5.13 | 1 |
| emeraldpay/ | ac2a4bc66ab6 | httpclient | 4.5.13 | 1 |
| empathyco/ | 03e724e41eeb | httpclient | 4.5.13 | 1 |
| fimperato/ | 604012b77841 | httpclient | 4.5.13 | 1 |
| fiware/ | 92a3c5cf43c0 | httpclient | 4.5.13 | 1 |
| fiware/ | efc6793388cc | httpclient | 4.5.13 | 1 |
| folioci/ | 682b852e056d | httpclient | 4.5.13 | 1 |
| fonoster/ | 2ca65af17cbc | httpclient | 4.5.13 | 1 |
| geoservercloud/ | ca58b74529cd | httpclient | 4.5.13 | 1 |
| geoservercloud/ | 5dc0c93a1710 | httpclient | 4.5.13 | 1 |
| geoservercloud/ | 47ae1bdb4bcc | httpclient | 4.5.13 | 1 |
| geoservercloud/ | 28c3e5a8c5a3 | httpclient | 4.5.13 | 1 |
| geoservercloud/ | 8c70ee06d5ab | httpclient | 4.5.13 | 1 |
| geoservercloud/ | 42775ba6a4da | httpclient | 4.5.13 | 1 |
| glarad/ | 7b02b9e7f1ef | httpclient | 4.5.13 | 1 |
| gluufederation/ | 1a1128b28b95 | httpclient | 4.5.13 | 1 |
| gocd/ | 53588bd3221f | httpclient | 4.5.13 | 1 |
| gocd/ | 2da45cb09d57 | httpclient | 4.5.13 | 1 |
| gradiant/ | e3bf364fe713 | httpclient | 4.5.13 | 1 |
| graviteeio/ | 07b7f6dc267a | httpclient | 4.5.13 | 1 |
| graviteeio/ | a8eb04ee0c70 | httpclient | 4.5.13 | 1 |
| graylog2/ | 8ff28c66e6c1 | httpclient | 4.5.13 | 1 |
| gridgain/ | d32d182a0e6a | httpclient | 4.5.13 | 1 |
| hazelcast/ | ca7d5589744f | httpclient | 4.5.13 | 1 |
| hazelcast/ | df495e64ea65 | httpclient | 4.5.13 | 1 |
| ibmcom/ | 5441dba2fa00 | httpclient | 4.5.13 | 1 |
| ibmcom/ | e31ff09e8aad | httpclient | 4.5.13 | 1 |
| ibmcom/ | 7e4dc1e27cdf | httpclient | 4.5.13 | 1 |
| ibmcom/ | b558f2b444ae | httpclient | 4.5.13 | 1 |
| ibmcom/ | ab3fd1fdfa18 | httpclient | 4.5.13 | 1 |
| ibmcom/ | ed5505e5c7ec | httpclient | 4.5.13 | 1 |