CVE-2020-13956
MediumAdvisory
Published 3 Jun 2021In the index since 6 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.090
- 95th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 190
- of 17,781 indexed, latest versions
- Container images
- 217
- deployed by those charts
- Fix available
- 28 of 28
- affected packages
Cross-site scripting in Apache HttpClient
Carried by container images the latest versions of 190 of 17,781 indexed charts deploy, on 217 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| httpclientmaven | 4.0.1, 4.0.2, 4.2.5, 4.2.6+19 more | 4.5.13 | 217 |
| aopalliancerpm | 1.0-20.module+el8.3.0+6804+157bd82e | 0:1.0-20.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-clirpm | 1.4-7.module+el8.3.0+6804+157bd82e | 0:1.4-7.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-codecrpm | 1.13-3.module+el8.3.0+6804+157bd82e | 0:1.13-3.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-iorpm | 1:2.6-6.module+el8.3.0+6804+157bd82e | 1:2.6-6.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-lang3rpm | 3.9-4.module+el8.3.0+6804+157bd82e | 0:3.9-4.module+el8.6.0+13337+afcb49ec | 5 |
| atinjectrpm | 1-31.20100611svn86.module+el8.3.0+6804+157bd82e | 0:1-31.20100611svn86.module+el8.6.0+13337+afcb49ec | 5 |
| cdi-apirpm | 2.0.1-3.module+el8.3.0+6804+157bd82e | 0:2.0.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| geronimo-annotationrpm | 1.0-26.module+el8.3.0+6804+157bd82e | 0:1.0-26.module+el8.6.0+13337+afcb49ec | 5 |
| google-guicerpm | 4.2.2-4.module+el8.3.0+6804+157bd82e | 0:4.2.2-4.module+el8.6.0+13337+afcb49ec | 5 |
| guavarpm | 28.1-3.module+el8.3.0+6804+157bd82e | 0:28.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| httpcomponents-clientrpm | 4.5.10-3.module+el8.3.0+6804+157bd82e | 0:4.5.10-4.module+el8.6.0+13337+afcb49ec | 5 |
| httpcomponents-corerpm | 4.4.12-3.module+el8.3.0+6804+157bd82e | 0:4.4.12-3.module+el8.6.0+13337+afcb49ec | 5 |
| jansirpm | 1.18-4.module+el8.3.0+6804+157bd82e | 0:1.18-4.module+el8.6.0+13337+afcb49ec | 5 |
| jsouprpm | 1.12.1-3.module+el8.3.0+6804+157bd82e | 0:1.12.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| jsr-305rpm | 0-0.25.20130910svn.module+el8.3.0+6804+157bd82e | 0:0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec | 5 |
| mavenrpm | 1:3.6.2-6.module+el8.4.0+9250+1786af37 | 1:3.6.2-7.module+el8.6.0+13337+afcb49ec | 5 |
| maven-resolverrpm | 1.4.1-3.module+el8.3.0+6804+157bd82e | 0:1.4.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| maven-shared-utilsrpm | 3.2.1-0.4.module+el8.3.0+6804+157bd82e | 0:3.2.1-0.4.module+el8.6.0+13337+afcb49ec | 5 |
| maven-wagonrpm | 3.3.4-2.module+el8.3.0+6804+157bd82e | 0:3.3.4-2.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-cipherrpm | 1.7-17.module+el8.3.0+6804+157bd82e | 0:1.7-17.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-classworldsrpm | 2.6.0-4.module+el8.3.0+6804+157bd82e | 0:2.6.0-4.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-containersrpm | 2.1.0-2.module+el8.3.0+6804+157bd82e | 0:2.1.0-2.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-interpolationrpm | 1.26-3.module+el8.3.0+6804+157bd82e | 0:1.26-3.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-sec-dispatcherrpm | 1.4-29.module+el8.3.0+6804+157bd82e | 0:1.4-29.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-utilsrpm | 3.3.0-3.module+el8.3.0+6804+157bd82e | 0:3.3.0-3.module+el8.6.0+13337+afcb49ec | 5 |
| sisurpm | 0.3.4-2.module+el8.3.0+6804+157bd82e | 0:0.3.4-2.module+el8.6.0+13337+afcb49ec | 5 |
| slf4jrpm | 1.7.28-3.module+el8.3.0+6804+157bd82e | 0:1.7.28-3.module+el8.6.0+13337+afcb49ec | 5 |
- OSV records
- GHSA-7r82-7xv7-xcpjRHSA-2022:1860
Charts affected
190 by stars
Container images carrying it
217 by charts deploying them
A fixed version is listed for 28 of the 28 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ibmcom/ | e17bdccc5030 | httpclient | 4.5.13 | 1 |
| jacobalberty/ | 4a3616625dda | httpclient | 4.5.13 | 1 |
| jacobalberty/ | c409924e2463 | httpclient | 4.5.13 | 1 |
| jenkinsci/ | a1f33f004659 | httpclient | 4.5.13 | 1 |
| keyfactor/ | 798fbbe00283 | httpclient | 4.5.13 | 1 |
| krontechnology/ | 7feef7d2ab42 | httpclient | 4.5.13 | 1 |
| kyso/ | 68091eace89c | httpclient | 4.5.13 | 1 |
| ladeit/ | 962b665ffe82 | httpclient | 4.5.13 | 1 |
| lavandadelpatio/ | 94e225a5a6f8 | httpclient | 4.5.13 | 1 |
| lavandadelpatio/ | 92de3c3426d2 | httpclient | 4.5.13 | 1 |
| library/ | c7984a05e15b | httpclient | 4.5.13 | 1 |
| library/ | 332c6d416808 | httpclient | 4.5.13 | 1 |
| library/ | 88c2ec10c7f2 | httpclient | 4.5.13 | 1 |
| library/ | fdc73b3249c1 | httpclient | 4.5.13 | 1 |
| library/ | 1fe4fb22a2a5 | httpclient | 4.5.13 | 1 |
| library/ | d124efd81fbb | httpclient | 4.5.13 | 1 |
| library/ | 0ae5169e3d0f | httpclient | 4.5.13 | 1 |
| library/ | 7e43ff493a47 | httpclient | 4.5.13 | 1 |
| library/ | a246bc64207e | httpclient | 4.5.13 | 1 |
| library/ | a9bc5a3a1fc3 | httpclient | 4.5.13 | 1 |
| library/ | eb2f0be32efd | httpclient | 4.5.13 | 1 |
| library/ | bd5d420506d6 | httpclient | 4.5.13 | 1 |
| lightbend/ | 0bedf37f428a | httpclient | 4.5.13 | 1 |
| linuxserver/ | b6ce6968ee45 | httpclient | 4.5.13 | 1 |
| massimolauri/ | e08abf0ce767 | httpclient | 4.5.13 | 1 |
| metabase/ | ffb2dccacefc | httpclient | 4.5.13 | 1 |
| microcks/ | e3a3e0c67b09 | httpclient | 4.5.13 | 1 |
| mintproject/ | ffbb13f20465 | httpclient | 4.5.13 | 1 |
| muluder/ | 43b597a93da7 | httpclient | 4.5.13 | 1 |
| nacos/ | fe6e5688cdf3 | httpclient | 4.5.13 | 1 |
| ncsapolyglot/ | c44b22eb58bb | httpclient | 4.5.13 | 1 |
| ncsapolyglot/ | 438d82cdbdb5 | httpclient | 4.5.13 | 1 |
| ncsapolyglot/ | 48c852c1204b | httpclient | 4.5.13 | 1 |
| ncsapolyglot/ | 072cf5bc6f99 | httpclient | 4.5.13 | 1 |
| ncsapolyglot/ | f746049515c1 | httpclient | 4.5.13 | 1 |
| ncsapolyglot/ | f350da56dd55 | httpclient | 4.5.13 | 1 |
| ncsapolyglot/ | 317dd9e56922 | httpclient | 4.5.13 | 1 |
| ncsapolyglot/ | d244ea8c32ac | httpclient | 4.5.13 | 1 |
| ncsapolyglot/ | 2ba4af461d51 | httpclient | 4.5.13 | 1 |
| ncsapolyglot/ | 30ee96508c0b | httpclient | 4.5.13 | 1 |
| ncsapolyglot/ | 1d9cebe3022b | httpclient | 4.5.13 | 1 |
| ncsapolyglot/ | f889fe30e2c7 | httpclient | 4.5.13 | 1 |
| ncsapolyglot/ | 97a8c01c076e | httpclient | 4.5.13 | 1 |
| novumrgi/ | 8c54790675b1 | httpclient | 4.5.13 | 1 |
| omecproject/ | b4ae7d0d6b74 | httpclient | 4.5.13 | 1 |
| omecproject/ | 5715e5648aa0 | httpclient | 4.5.13 | 1 |
| onosproject/ | 44914a8d4b3f | httpclient | 4.5.13 | 1 |
| opencord/ | 4187e2a8c918 | httpclient | 4.5.13 | 1 |
| openhab/ | 29dd2bac8c4b | httpclient | 4.5.13 | 1 |
| openkm/ | 3bc465a7461b | httpclient | 4.5.13 | 1 |