CVE-2020-1925

Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker.

• CWE-918

• https://mail-archives.apache.org/mod_mbox/olingo-user/202001.mbox/%3CCAGSZ4d6HwpF2woOrZJg_d0SkHytXJaCtAWXa3ZtBn33WG0YFvw%40mail.gmail.com%3EPatch, Third Party Advisory
• https://mail-archives.apache.org/mod_mbox/olingo-user/202001.mbox/%3CCAGSZ4d6HwpF2woOrZJg_d0SkHytXJaCtAWXa3ZtBn33WG0YFvw%40mail.gmail.com%3EPatch, Third Party Advisory

Published

Jan 9, 2020

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-19215SQL Injection vulnerability in admin/user_perm.php in piwigo…8.8
• CVE-2020-19216SQL Injection vulnerability in admin/user_perm.php in piwigo…8.8
• CVE-2020-19217SQL Injection vulnerability in admin/batch_manager.php in pi…8.8
• CVE-2020-19228An issue was found in bludit v3.13.0, unsafe implementation …7.2
• CVE-2020-19229Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected b…9.8
• CVE-2020-19248SQL Injection vulnerability in PbootCMS 1.4.1 in parsing if …5.1
• CVE-2020-1926Apache Hive cookie signature verification used a non constan…5.9
• CVE-2020-19263A cross-site request forgery (CSRF) in MipCMS v5.0.1 allows …8.8
• CVE-2020-19264A cross-site request forgery (CSRF) in MipCMS v5.0.1 allows …6.5
• CVE-2020-19265A stored cross-site scripting (XSS) vulnerability in the ind…6.1
• CVE-2020-19266A stored cross-site scripting (XSS) vulnerability in the ind…6.1
• CVE-2020-19267An issue in index.php/Dswjcms/Basis/resources of Dswjcms 1.6…9.8