CVE-2020-5280

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-5280

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5280.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-5280

Aliases

GHSA-66q9-f7ff-mmx6

Published

2020-03-25T18:15:14.237Z

Modified

2026-07-09T01:31:30.975138Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.

References

Affected packages

Git / github.com/http4s/http4s

Affected ranges

Type

GIT

Repo

https://github.com/http4s/http4s

Events

Introduced

Fixed

18b23dea4d2d033540dd100103a8d4cf05ae5171

Introduced

d7850459c5be7e9079df6007e6ddf9105973088b

Fixed

4e23069016098b8e36e8f9e0fa42d9b0166bf3b0

Introduced

0801749674a83afa3e7522f4e402d1bedea76982

Fixed

0a46b00a2c92d848e45ff0455e773dbe1b552858

Fixed

250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec

Fixed

752b3f63a05a31d2de4f8706877aa08d6b89efca

Fixed

b87f31b2292dabe667bec3b04ce66176c8a3e17b

Database specific

{
    "cpe": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.18.26"
        },
        {
            "introduced": "0.19.0"
        },
        {
            "fixed": "0.20.20"
        },
        {
            "introduced": "0.21.0"
        },
        {
            "fixed": "0.21.2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.1.0

v0.10.0

v0.11.0

v0.12.0

v0.13.0

v0.14.0

v0.14.1

v0.17.0-M1

v0.18.0

v0.18.0-M1

v0.18.0-M2

v0.18.0-M3

v0.18.0-M4

v0.18.0-M5

v0.18.0-M6

v0.18.0-M7

v0.18.0-M8

v0.18.0-M9

v0.18.1

v0.18.10

v0.18.11

v0.18.12

v0.18.13

v0.18.14

v0.18.15

v0.18.16

v0.18.17

v0.18.18

v0.18.19

v0.18.2

v0.18.20

v0.18.21

v0.18.22

v0.18.23

v0.18.24

v0.18.25

v0.18.3

v0.18.4

v0.18.5

v0.18.6

v0.18.7

v0.18.8

v0.18.9

v0.19.0

v0.2.0

v0.20.0

v0.20.0-M1

v0.20.0-M2

v0.20.0-M3

v0.20.0-M4

v0.20.0-M5

v0.20.0-M6

v0.20.0-M7

v0.20.0-RC1

v0.20.1

v0.20.10

v0.20.11

v0.20.14

v0.20.15

v0.20.16

v0.20.17

v0.20.18

v0.20.19

v0.20.2

v0.20.3

v0.20.4

v0.20.6

v0.20.7

v0.20.8

v0.20.9

v0.21.0

v0.21.1

v0.3.0

v0.5.0

v0.6.0

v0.7.0

v0.8.1

v0.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5280.json"