CVE-2024-45687: HTTP Server incorrectly accepting disallowed characters within header values
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Management Interface modules), Payara Platform Payara Micro (Grizzly modules) allows Manipulating State, Identity Spoofing.This issue affects Payara Server: from 4.1.151 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0; Payara Micro: from 4.1.152 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45687?
CVE-2024-45687 is classified as a moderate severity vulnerability due to its potential for manipulating state and identity spoofing.
How do I fix CVE-2024-45687?
To fix CVE-2024-45687, you should update your Payara Server or Payara Micro to the latest version that addresses this vulnerability.
Which versions are affected by CVE-2024-45687?
CVE-2024-45687 affects Payara Server versions between 4.1.151 and 4.1.2.191.51, 5.20.0 and 5.70.0, 6.0.0 and 6.21.0 as well as Payara Micro with similar version ranges.
What types of attacks can CVE-2024-45687 facilitate?
CVE-2024-45687 can facilitate HTTP request/response splitting attacks which may lead to state manipulation and identity spoofing.
Is there a workaround for CVE-2024-45687?
Currently, the best practice is to apply the necessary update to mitigate CVE-2024-45687, as no specific workarounds are provided.