7.5
CVE-2020-13935
- EPSS 86.61%
- Veröffentlicht 14.07.2020 15:15:11
- Zuletzt bearbeitet 08.10.2026 21:17:22
- Erkennungen
LoginThe payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version 9.0
Debian ≫ Debian Linux Version 10.0
Netapp ≫ Oncommand System Manager Version >= 3.0.0 <= 3.1.3
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition esm
Canonical ≫ Ubuntu Linux Version 20.04 SwEdition lts
Mcafee ≫ Epolicy Orchestrator Version 5.9.0
Mcafee ≫ Epolicy Orchestrator Version 5.9.1
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update -
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_1
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_2
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_3
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_4
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_5
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_6
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_7
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_8
Oracle ≫ Agile Engineering Data Management Version 6.2.1.0
Oracle ≫ Agile Product Lifecycle Management Version 9.3.3
Oracle ≫ Agile Product Lifecycle Management Version 9.3.5
Oracle ≫ Agile Product Lifecycle Management Version 9.3.6
Oracle ≫ Blockchain Platform Version < 21.1.2
Oracle ≫ Commerce Guided Search Version 11.3.2
Oracle ≫ Communications Cloud Native Core Policy Version 1.14.0
Oracle ≫ Communications Instant Messaging Server Version 10.0.1.5.0
Oracle ≫ Fmw Platform Version 12.2.1.3.0
Oracle ≫ Fmw Platform Version 12.2.1.4.0
Oracle ≫ Instantis Enterprisetrack Version 17.1
Oracle ≫ Instantis Enterprisetrack Version 17.2
Oracle ≫ Instantis Enterprisetrack Version 17.3
Oracle ≫ Managed File Transfer Version 12.2.1.3.0
Oracle ≫ Managed File Transfer Version 12.2.1.4.0
Oracle ≫ Mysql Enterprise Monitor Version <= 8.0.21
Oracle ≫ Siebel Ui Framework Version <= 20.12
Oracle ≫ Workload Manager Version 12.2.0.1
Oracle ≫ Workload Manager Version 18c
Oracle ≫ Workload Manager Version 19c
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 86.61% | 0.997 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| NIST | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:N/A:P
|
CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/security-alerts/cpuapr2021.html
https://usn.ubuntu.com/4448-1/
https://usn.ubuntu.com/4596-1/
https://www.debian.org/security/2020/dsa-4727
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html
https://security.netapp.com/advisory/ntap-20200724-0003/
https://kc.mcafee.com/corporate/index?page=content&id=SB10332
https://lists.apache.org/thread.html/r4e5d3c09f4dd2923191e972408b40fb8b42dbff0bc7904d44b651e50%40%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rd48c72bd3255bda87564d4da3791517c074d94f8a701f93b85752651%40%3Cannounce.tomcat.apache.org%3E