[Forgot Password]
Login  Register Subscribe

30479

 
 

423868

 
 

250770

 
 

909

 
 

196157

 
 

282

 
Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2012-5486Date: (C)2014-10-01   (M)2023-12-22


ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 6.4
Exploit Score: 10.0
Impact Score: 4.9
 
CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality: NONE
Integrity: PARTIAL
Availability: PARTIAL
  
Reference:
RHSA-2014:1194
http://www.openwall.com/lists/oss-security/2012/11/10/1
https://bugs.launchpad.net/zope2/+bug/930812
https://plone.org/products/plone-hotfix/releases/20121106
https://plone.org/products/plone/security/advisories/20121106/02

OVAL    2
oval:org.secpod.oval:def:203448
oval:org.secpod.oval:def:1500721

© SecPod Technologies