Man-in-the-Middle (MitM) Affecting org.apache.httpcomponents:httpclient package, versions [4.3,4.3.1)
Threat Intelligence
EPSS
0.11% (47th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-32018
- published 4 Dec 2017
- disclosed 30 Oct 2017
- credit Unknown
Introduced: 30 Oct 2017
CVE-2013-4366 Open this link in a new tabOverview
org.apache.httpcomponents:httpclient is responsible for creating and maintaining a toolset of low level Java components focused on HTTP and associated protocols.
Affected versions of this pacage are vulnerable to Man-in-the-Middle (MitM) attacks.
http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.
References
CVSS Scores
version 3.1