CVE-2020-11078

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-93CWE-74

Affected software

VendorProductVersions
httplib2httplib2< 0.81.0

References

Timeline

Published
May 20, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-110799.8node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if aCVE-2020-11087.5A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully explCVE-2020-110807.5In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involCVE-2020-110818.2osquery before version 4.4.0 enables a privilege escalation vulnerability. If a Window system is configured with a PATH that contains a userCVE-2020-110826.1In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. TCVE-2020-110834.8In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could CVE-2020-110845.4In iPear, the manual execution of the eval() function can lead to command injection. Only PCs where commands are manually executed via "For CVE-2020-110853.5In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data read (by client or server) might CVE-2020-110865.4In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-ofCVE-2020-110875.4In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage. This has been fixed in 2.1.0.CVE-2020-110885.4In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0.CVE-2020-110895.5In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_proce
CVE-2020-11078: Medium severity, CVSS 6.8 | Vulnix