CVE-2020-1925: CSRF
Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-1925?
CVE-2020-1925 is a vulnerability in Apache Olingo versions 4.0.0 to 4.7.0 that allows for SSRF attacks.
What is the severity of CVE-2020-1925?
The severity of CVE-2020-1925 is high with a CVSS score of 7.5.
How does CVE-2020-1925 work?
CVE-2020-1925 allows an attacker to trick a client into connecting to a malicious server, which can then make GET or DELETE requests to arbitrary URLs.
Is there a fix for CVE-2020-1925?
Yes, the fix for CVE-2020-1925 is to upgrade to a version of Apache Olingo that is not affected by the vulnerability.
Where can I find more information about CVE-2020-1925?
You can find more information about CVE-2020-1925 on the CVE website and NIST NVD website.