Описание
This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting.
Ссылки
- PatchThird Party Advisory
- ExploitThird Party Advisory
- PatchThird Party Advisory
- PatchThird Party Advisory
- ExploitThird Party Advisory
- PatchThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.6.9 (исключая)Версия от 2.0.0 (включая) до 2.2.1 (исключая)
Одно из
cpe:2.3:a:jooby:jooby:*:*:*:*:*:*:*:*
cpe:2.3:a:jooby:jooby:*:*:*:*:*:*:*:*
EPSS
Процентиль: 63%
0.00451
Низкий
6.5 Medium
CVSS3
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
NVD-CWE-Other
Связанные уязвимости
CVSS3: 9.8
github
почти 6 лет назад
Improper Neutralization of CRLF Sequences in HTTP Headers in Jooby ('HTTP Response Splitting)
EPSS
Процентиль: 63%
0.00451
Низкий
6.5 Medium
CVSS3
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
NVD-CWE-Other