CVE-2020-7670

agoo prior to 2.14.0 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks where `agoo` is used as part of a chain of backend servers due to insufficient `Content-Length` and `Transfer Encoding` parsing.

Score
CVSS 3.1 7.5 High
Status
Modified - report@snyk.io
Published
2020-06-10
Last modified
2024-08-04
Weaknesses
CWE-444

Affected products

References

 
 
© AVABIS GmbH privacypolicy about