CVE-2020-11078 — CVE & Security Advisory Radar

🎯 CVE-2020-11078 MEDIUM 6.8 🔥 EPSS 2.6% 🧪 PoC 🇪🇺 EUVD

📄 .md Alle CVEs anzeigen ✕

CVE-2020-11078 | In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.

In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.

Klassifikation & Betroffenheit:

httplib2 httplib2 < 0.81.0httplib2_project httplib2 *fedoraproject fedora 31fedoraproject fedora 32debian debian_linux 8.0

Improper Control of Generation of Code ('Code Injection') 🎯 Medium

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

🛡️ Empfohlene Mitigation: Refactor your program so that you do not have to dynamically generate code.

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-35 · Leverage Executable Code in Non-Executab… (Very High) CAPEC-77 · Manipulating User-Controlled Variables (Very High) CAPEC-242 · Code Injection (High)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1027.006 · Obfuscated Files or Information: H… T1027.009 · Obfuscated Files or Information: E… T1564.009 · Hide Artifacts: Resource Forking

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-59939 7.5 CVE-2021-21240 7.5

🩹 Patch verfügbar (OSV):

🩹 8373177d3a9e4dd9c956f9bded22a5f96a00957b (Commit) 🩹 a1457cc31f3206cf691d11d2bf34e98865873e9e (Commit)

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2020

Veröffentlicht 05/2020

Heute 08.09.

CVSS-Vektor-Analyse: 6.8

AV · Angriffsvektor Netzwerk

AC · Komplexität Hoch

PR · Privilegien Keine

UI · Interaktion Keine

S · Scope Verändert

C · Vertraulichkeit Keine

I · Integrität Hoch

A · Verfügbarkeit Keine

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Veröffentlicht:20.05.2020

Aktualisiert:17.06.2026 02:49

Assigner (CNA):GitHub_M

EUVD-ID:EUVD-2020-0085

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	2026-08-29	2026-09-06
≥90 %	4	0
≥50 %	4	0
≥10 %	3	0
<10 %	304	300

6.8 MEDIUM

🇪🇺 EUVD

EPSS

2.6%

CVE-2020-11078 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

🧪 httplib2

CVE-2020-11078 | In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

20.05.2020

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub