CVE-2020-7622

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Apr 6, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-76239.8jscover through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary command via the source argument.CVE-2020-76249.8effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument.CVE-2020-76259.8op-browser through 1.0.6 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function.CVE-2020-76269.8karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument.CVE-2020-76279.8node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the 'arrParams' argument inCVE-2020-76289.8umount through 1.1.6 is vulnerable to Command Injection. The argument device can be controlled by users without any sanitization.CVE-2020-76299.8install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.CVE-2020-76309.8git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument.CVE-2020-76319.8diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument.CVE-2020-76329.8node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.CVE-2020-76339.8apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argumentCVE-2020-76349.8heroku-addonpool through 0.1.15 is vulnerable to Command Injection.
CVE-2020-7622: Critical severity, CVSS 9.8 | Vulnix