icon

We found results for “

CVE-2024-53990

Good to know:

icon
icon

Date: December 2, 2024

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore (aka cookie jar) will silently replace explicitly defined Cookies with any that have the same name from the cookie jar. For services that operate with multiple users, this can result in one user's Cookie being used for another user's requests.

Language: Java

Severity Score

Severity Score

Weakness Type (CWE)

Improper Authentication

CWE-287

Top Fix

icon

Upgrade Version

Upgrade to version org.asynchttpclient:async-http-client:3.0.1;org.asynchttpclient:async-http-client:2.12.4;https://github.com/AsyncHttpClient/async-http-client.git - async-http-client-project-2.12.4;https://github.com/AsyncHttpClient/async-http-client.git - async-http-client-project-3.0.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

Do you need more information?

Contact Us