CVE-2020-13956
MediumAdvisory
Published 3 Jun 2021In the index since 6 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.090
- 95th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 190
- of 17,781 indexed, latest versions
- Container images
- 217
- deployed by those charts
- Fix available
- 28 of 28
- affected packages
Cross-site scripting in Apache HttpClient
Carried by container images the latest versions of 190 of 17,781 indexed charts deploy, on 217 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| httpclientmaven | 4.0.1, 4.0.2, 4.2.5, 4.2.6+19 more | 4.5.13 | 217 |
| aopalliancerpm | 1.0-20.module+el8.3.0+6804+157bd82e | 0:1.0-20.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-clirpm | 1.4-7.module+el8.3.0+6804+157bd82e | 0:1.4-7.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-codecrpm | 1.13-3.module+el8.3.0+6804+157bd82e | 0:1.13-3.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-iorpm | 1:2.6-6.module+el8.3.0+6804+157bd82e | 1:2.6-6.module+el8.6.0+13337+afcb49ec | 5 |
| apache-commons-lang3rpm | 3.9-4.module+el8.3.0+6804+157bd82e | 0:3.9-4.module+el8.6.0+13337+afcb49ec | 5 |
| atinjectrpm | 1-31.20100611svn86.module+el8.3.0+6804+157bd82e | 0:1-31.20100611svn86.module+el8.6.0+13337+afcb49ec | 5 |
| cdi-apirpm | 2.0.1-3.module+el8.3.0+6804+157bd82e | 0:2.0.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| geronimo-annotationrpm | 1.0-26.module+el8.3.0+6804+157bd82e | 0:1.0-26.module+el8.6.0+13337+afcb49ec | 5 |
| google-guicerpm | 4.2.2-4.module+el8.3.0+6804+157bd82e | 0:4.2.2-4.module+el8.6.0+13337+afcb49ec | 5 |
| guavarpm | 28.1-3.module+el8.3.0+6804+157bd82e | 0:28.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| httpcomponents-clientrpm | 4.5.10-3.module+el8.3.0+6804+157bd82e | 0:4.5.10-4.module+el8.6.0+13337+afcb49ec | 5 |
| httpcomponents-corerpm | 4.4.12-3.module+el8.3.0+6804+157bd82e | 0:4.4.12-3.module+el8.6.0+13337+afcb49ec | 5 |
| jansirpm | 1.18-4.module+el8.3.0+6804+157bd82e | 0:1.18-4.module+el8.6.0+13337+afcb49ec | 5 |
| jsouprpm | 1.12.1-3.module+el8.3.0+6804+157bd82e | 0:1.12.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| jsr-305rpm | 0-0.25.20130910svn.module+el8.3.0+6804+157bd82e | 0:0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec | 5 |
| mavenrpm | 1:3.6.2-6.module+el8.4.0+9250+1786af37 | 1:3.6.2-7.module+el8.6.0+13337+afcb49ec | 5 |
| maven-resolverrpm | 1.4.1-3.module+el8.3.0+6804+157bd82e | 0:1.4.1-3.module+el8.6.0+13337+afcb49ec | 5 |
| maven-shared-utilsrpm | 3.2.1-0.4.module+el8.3.0+6804+157bd82e | 0:3.2.1-0.4.module+el8.6.0+13337+afcb49ec | 5 |
| maven-wagonrpm | 3.3.4-2.module+el8.3.0+6804+157bd82e | 0:3.3.4-2.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-cipherrpm | 1.7-17.module+el8.3.0+6804+157bd82e | 0:1.7-17.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-classworldsrpm | 2.6.0-4.module+el8.3.0+6804+157bd82e | 0:2.6.0-4.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-containersrpm | 2.1.0-2.module+el8.3.0+6804+157bd82e | 0:2.1.0-2.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-interpolationrpm | 1.26-3.module+el8.3.0+6804+157bd82e | 0:1.26-3.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-sec-dispatcherrpm | 1.4-29.module+el8.3.0+6804+157bd82e | 0:1.4-29.module+el8.6.0+13337+afcb49ec | 5 |
| plexus-utilsrpm | 3.3.0-3.module+el8.3.0+6804+157bd82e | 0:3.3.0-3.module+el8.6.0+13337+afcb49ec | 5 |
| sisurpm | 0.3.4-2.module+el8.3.0+6804+157bd82e | 0:0.3.4-2.module+el8.6.0+13337+afcb49ec | 5 |
| slf4jrpm | 1.7.28-3.module+el8.3.0+6804+157bd82e | 0:1.7.28-3.module+el8.6.0+13337+afcb49ec | 5 |
- OSV records
- GHSA-7r82-7xv7-xcpjRHSA-2022:1860
Charts affected
190 by stars
Container images carrying it
217 by charts deploying them
A fixed version is listed for 28 of the 28 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| gradiant/ | 3b28784ba41f | httpclient | 4.5.13 | 7 |
| bde2020/ | 620267768985 | httpclient | 4.5.13 | 4 |
| gradiant/ | a1ee6de94c04 | httpclient | 4.5.13 | 4 |
| apache/ | e8b7c4ddd069 | httpclient | 4.5.13 | 3 |
| apache/ | 0bd3b25c4be4 | httpclient | 4.5.13 | 3 |
| jacobalberty/ | 896c0ab82d33 | httpclient | 4.5.13 | 3 |
| amazon/ | 2acfa1dcc5f8 | httpclient | 4.5.13 | 2 |
| apache/ | 0116fb802786 | httpclient | 4.5.13 | 2 |
| apachepulsar/ | b341ef76a852 | httpclient | 4.5.13 | 2 |
| danisla/ | 255ba2dd739b | httpclient | 4.5.13 | 2 |
| empathyco/ | bcf4365ee7ec | httpclient | 4.5.13 | 2 |
| geoservercloud/ | 756559ee788a | httpclient | 4.5.13 | 2 |
| geoservercloud/ | 99540eef78ad | httpclient | 4.5.13 | 2 |
| geoservercloud/ | 5c254c53a357 | httpclient | 4.5.13 | 2 |
| geoservercloud/ | c687b1cbc891 | httpclient | 4.5.13 | 2 |
| geoservercloud/ | 5288f320cf36 | httpclient | 4.5.13 | 2 |
| geoservercloud/ | a30a60ac6cd0 | httpclient | 4.5.13 | 2 |
| gradiant/ | aae4f8a21f8b | httpclient | 4.5.13 | 2 |
| gradiant/ | c33d53913869 | httpclient | 4.5.13 | 2 |
| gradiant/ | 97657d56e927 | httpclient | 4.5.13 | 2 |
| library/ | 5e6ac15bf6a5 | httpclient | 4.5.13 | 2 |
| mbentley/ | f4e682274bed | httpclient | 4.5.13 | 2 |
| nacos/ | dcf04549c6d7 | httpclient | 4.5.13 | 2 |
| opensearchproject/ | 4254021a8c71 | httpclient | 4.5.13 | 2 |
| rodolpheche/ | 3be08a386092 | httpclient | 4.5.13 | 2 |
| scorpiobroker/ | c46c1517e523 | httpclient | 4.5.13 | 2 |
| stakater/ | 954d2be66e95 | httpclient | 4.5.13 | 2 |
| 5200710/ | e34ab066d2ed | httpclient | 4.5.13 | 1 |
| amazon/ | 6df71eb04639 | httpclient | 4.5.13 | 1 |
| andrianrf/ | 46abe878d9d8 | httpclient | 4.5.13 | 1 |
| apache/ | 0cef139b6bf1 | httpclient | 4.5.13 | 1 |
| apache/ | 80136ae753ee | httpclient | 4.5.13 | 1 |
| apacheignite/ | d7deab68b8fa | httpclient | 4.5.13 | 1 |
| apache/ | 090b7f87ec7f | httpclient | 4.5.13 | 1 |
| apache/ | 974efa2f21da | httpclient | 4.5.13 | 1 |
| apachepulsar/ | 4db6ff0b4045 | httpclient | 4.5.13 | 1 |
| apache/ | 641237e0299b | httpclient | 4.5.13 | 1 |
| apache/ | 67d50e4deff4 | httpclient | 4.5.13 | 1 |
| apache/ | 80530f0308a5 | httpclient | 4.5.13 | 1 |
| apicurio/ | a97d67487532 | aopalliance apache-commons-cli apache-commons-codec apache-commons-io apache-commons-lang3 atinject cdi-api geronimo-annotation google-guice guava httpclient httpcomponents-client httpcomponents-core jansi jsoup jsr-305 maven maven-resolver maven-shared-utils maven-wagon plexus-cipher plexus-classworlds plexus-containers plexus-interpolation plexus-sec-dispatcher plexus-utils sisu slf4j | 0:1.0-20.module+el8.6.0+13337+afcb49ec 0:1.4-7.module+el8.6.0+13337+afcb49ec 0:1.13-3.module+el8.6.0+13337+afcb49ec 1:2.6-6.module+el8.6.0+13337+afcb49ec 0:3.9-4.module+el8.6.0+13337+afcb49ec 0:1-31.20100611svn86.module+el8.6.0+13337+afcb49ec 0:2.0.1-3.module+el8.6.0+13337+afcb49ec 0:1.0-26.module+el8.6.0+13337+afcb49ec 0:4.2.2-4.module+el8.6.0+13337+afcb49ec 0:28.1-3.module+el8.6.0+13337+afcb49ec 4.5.13 0:4.5.10-4.module+el8.6.0+13337+afcb49ec 0:4.4.12-3.module+el8.6.0+13337+afcb49ec 0:1.18-4.module+el8.6.0+13337+afcb49ec 0:1.12.1-3.module+el8.6.0+13337+afcb49ec 0:0-0.25.20130910svn.module+el8.6.0+13337+afcb49ec 1:3.6.2-7.module+el8.6.0+13337+afcb49ec 0:1.4.1-3.module+el8.6.0+13337+afcb49ec 0:3.2.1-0.4.module+el8.6.0+13337+afcb49ec 0:3.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7-17.module+el8.6.0+13337+afcb49ec 0:2.6.0-4.module+el8.6.0+13337+afcb49ec 0:2.1.0-2.module+el8.6.0+13337+afcb49ec 0:1.26-3.module+el8.6.0+13337+afcb49ec 0:1.4-29.module+el8.6.0+13337+afcb49ec 0:3.3.0-3.module+el8.6.0+13337+afcb49ec 0:0.3.4-2.module+el8.6.0+13337+afcb49ec 0:1.7.28-3.module+el8.6.0+13337+afcb49ec | 1 |
| assistiot/ | db9361dad79b | httpclient | 4.5.13 | 1 |
| assistiot/ | ba1d85ec3739 | httpclient | 4.5.13 | 1 |
| assistiot/ | ae8b3d72eb5d | httpclient | 4.5.13 | 1 |
| assistiot/ | 4228b7a8ef40 | httpclient | 4.5.13 | 1 |
| assistiot/ | ea254b6d8a31 | httpclient | 4.5.13 | 1 |
| atlassian/ | 3b9222ab32ef | httpclient | 4.5.13 | 1 |
| atlassian/ | 37bc46cbec1a | httpclient | 4.5.13 | 1 |
| atomix/ | 7738ff4f5c63 | httpclient | 4.5.13 | 1 |
| bivas/ | 05545994f806 | httpclient | 4.5.13 | 1 |
| choerodon/ | 3c94c97f6f69 | httpclient | 4.5.13 | 1 |