CVE-2015-2028

Опубликовано: 04 окт. 2015

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.

Комментарий

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

Ссылки

http://www-01.ibm.com/support/docview.wss?uid=swg1PI44098
Patch
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1PI44105
Patch
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21966044
Patch
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1PI44098
Patch
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1PI44105
Patch
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21966044
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:websphere_extreme_scale:7.1.0:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_extreme_scale:7.1.0.2:*:*:*:*:*:*:*

cpe:2.3:a:ibm:websphere_extreme_scale:7.1.1:*:*:*:*:*:*:*

EPSS

Процентиль: 48%

0.00246

Низкий

4.3 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-wqw8-8hj5-2fxj

github

больше 3 лет назад