5.3
CVE-2020-27223
- EPSS 33.82%
- Published 26.02.2021 22:15:19
- Last modified 20.08.2025 10:15:27
- Source emo@eclipse.org
- Teams watchlist Login
- Open Login
In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.
Data is provided by the National Vulnerability Database (NVD)
Netapp ≫ E-series Santricity Os Controller Version >= 11.0.0 <= 11.70.1
Netapp ≫ E-series Santricity Web Services Version- SwPlatformweb_services_proxy
Netapp ≫ Element Plug-in For Vcenter Server Version-
Netapp ≫ Hci Management Node Version-
Netapp ≫ Management Services For Element Software Version-
Netapp ≫ Snap Creator Framework Version-
Netapp ≫ Snapcenter Version-
Netapp ≫ Snapmanager Version- SwPlatformoracle
Netapp ≫ Snapmanager Version- SwPlatformsap
Debian ≫ Debian Linux Version10.0
Oracle ≫ Rest Data Services SwEdition- Version < 20.4.3.050.1904
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 33.82% | 0.968 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:N/A:P
|
| emo@eclipse.org | 5.2 | 1.5 | 3.6 |
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
|
CWE-400 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CWE-407 Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.