CVE-2020-11724

High

Description

An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API.

SeverityHigh

CVSS7.5

Exploit probability—

Product

Openresty

PublishedApr 12, 2020

First seenApr 12, 2020

How to fix

Update

openresty openresty1.15.8.4 or later

Vendor advisories

debian.org/security/2020/dsa-4750

Affected products

Product	Affected versions	Fixed in
openresty openresty	v < 1.15.8.4	1.15.8.4
debian debian_linux	9.0, 10.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.