CVE-2015-5285

Опубликовано: 29 окт. 2015

Источник: nvd

CVSS2: 5

EPSS Низкий

Описание

CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the came_from parameter to _admin/login.

Комментарий

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

Ссылки

http://packetstormsecurity.com/files/133897/Kallithea-0.2.9-HTTP-Response-Splitting.html
Exploit
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5267.php
Exploit
https://kallithea-scm.org/security/cve-2015-5285.html
Exploit
Patch
Vendor Advisory
https://www.exploit-db.com/exploits/38424/
Exploit
http://packetstormsecurity.com/files/133897/Kallithea-0.2.9-HTTP-Response-Splitting.html
Exploit
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5267.php
Exploit
https://kallithea-scm.org/security/cve-2015-5285.html
Exploit
Patch
Vendor Advisory
https://www.exploit-db.com/exploits/38424/
Exploit

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:kallithea-scm:kallithea:*:*:*:*:*:*:*:*

Версия до 0.2 (включая)

EPSS

Процентиль: 93%

0.06039

Низкий

5 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

CVE-2015-5285

debian

почти 11 лет назад

CRLF injection vulnerability in Kallithea before 0.3 allows remote att ...

GHSA-vfg9-phjp-9frw

CVSS3: 9.8

github

больше 4 лет назад

Kallithea CRLF injection vulnerability