Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2024-45687

Summary
Assigner-Payara
Assigner Org ID-769c9ae7-73c3-4e47-ae19-903170fc3eb8
Published At-21 Jan, 2025 | 16:35
Updated At-12 Feb, 2025 | 20:41
Rejected At-
Credits

HTTP Server incorrectly accepting disallowed characters within header values

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Management Interface modules), Payara Platform Payara Micro (Grizzly modules) allows Manipulating State, Identity Spoofing.This issue affects Payara Server: from 4.1.151 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0; Payara Micro: from 4.1.152 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:Payara
Assigner Org ID:769c9ae7-73c3-4e47-ae19-903170fc3eb8
Published At:21 Jan, 2025 | 16:35
Updated At:12 Feb, 2025 | 20:41
Rejected At:
▼CVE Numbering Authority (CNA)
HTTP Server incorrectly accepting disallowed characters within header values

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Management Interface modules), Payara Platform Payara Micro (Grizzly modules) allows Manipulating State, Identity Spoofing.This issue affects Payara Server: from 4.1.151 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0; Payara Micro: from 4.1.152 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0.

Affected Products
Vendor
Payara Platform
Product
Payara Server
Modules
  • Grizzly
  • REST Management Interface
Default Status
unaffected
Versions
Affected
  • From 4.1.151 through 4.1.2.191.51 (custom)
  • From 5.20.0 through 5.70.0 (semver)
  • From 5.2020.2 through 5.2022.5 (semver)
  • From 6.2022.1 through 6.2024.12 (semver)
  • From 6.0.0 through 6.21.0 (semver)
Vendor
Payara Platform
Product
Payara Micro
Modules
  • Grizzly
Default Status
unaffected
Versions
Affected
  • From 4.1.152 through 4.1.2.191.51 (custom)
  • From 5.20.0 through 5.70.0 (semver)
  • From 5.2020.2 through 5.2022.5 (semver)
  • From 6.2022.1 through 6.2024.12 (semver)
  • From 6.0.0 through 6.21.0 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-113CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Type: CWE
CWE ID: CWE-113
Description: CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Metrics
VersionBase scoreBase severityVector
4.02.4LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N
Version: 4.0
Base score: 2.4
Base severity: LOW
Vector:
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-74CAPEC-74 Manipulating State
CAPEC-151CAPEC-151 Identity Spoofing
CAPEC ID: CAPEC-74
Description: CAPEC-74 Manipulating State
CAPEC ID: CAPEC-151
Description: CAPEC-151 Identity Spoofing
Solutions
Configurations
Workarounds
Exploits
Credits
reporter
Ben Kallus
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.22.0.html
release-notes
https://docs.payara.fish/enterprise/docs/5.71.0/Release%20Notes/Release%20Notes%205.71.0.html
release-notes
https://docs.payara.fish/community/docs/6.2025.1/Release%20Notes/Release%20Notes%206.2025.1.html
release-notes
Hyperlink: https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.22.0.html
Resource:
release-notes
Hyperlink: https://docs.payara.fish/enterprise/docs/5.71.0/Release%20Notes/Release%20Notes%205.71.0.html
Resource:
release-notes
Hyperlink: https://docs.payara.fish/community/docs/6.2025.1/Release%20Notes/Release%20Notes%206.2025.1.html
Resource:
release-notes
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:769c9ae7-73c3-4e47-ae19-903170fc3eb8
Published At:21 Jan, 2025 | 17:15
Updated At:21 Jan, 2025 | 17:15

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Management Interface modules), Payara Platform Payara Micro (Grizzly modules) allows Manipulating State, Identity Spoofing.This issue affects Payara Server: from 4.1.151 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0; Payara Micro: from 4.1.152 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary4.02.4LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:X/V:X/RE:X/U:X
Type: Secondary
Version: 4.0
Base score: 2.4
Base severity: LOW
Vector:
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:X/V:X/RE:X/U:X
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-113Secondary769c9ae7-73c3-4e47-ae19-903170fc3eb8
CWE ID: CWE-113
Type: Secondary
Source: 769c9ae7-73c3-4e47-ae19-903170fc3eb8
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://docs.payara.fish/community/docs/6.2025.1/Release%20Notes/Release%20Notes%206.2025.1.html769c9ae7-73c3-4e47-ae19-903170fc3eb8
N/A
https://docs.payara.fish/enterprise/docs/5.71.0/Release%20Notes/Release%20Notes%205.71.0.html769c9ae7-73c3-4e47-ae19-903170fc3eb8
N/A
https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.22.0.html769c9ae7-73c3-4e47-ae19-903170fc3eb8
N/A
Hyperlink: https://docs.payara.fish/community/docs/6.2025.1/Release%20Notes/Release%20Notes%206.2025.1.html
Source: 769c9ae7-73c3-4e47-ae19-903170fc3eb8
Resource: N/A
Hyperlink: https://docs.payara.fish/enterprise/docs/5.71.0/Release%20Notes/Release%20Notes%205.71.0.html
Source: 769c9ae7-73c3-4e47-ae19-903170fc3eb8
Resource: N/A
Hyperlink: https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.22.0.html
Source: 769c9ae7-73c3-4e47-ae19-903170fc3eb8
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

0Records found
Details not found