PT-2005-4720 · Unknown · Webcalendar

Publicado 2005-12-04 · Atualizado 2018-10-19 · CVE-2005-3982

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WebCalendar version 1.0.1

Description A CRLF injection issue exists, potentially allowing remote attackers to modify HTTP headers and conduct HTTP response splitting attacks. This is achieved via the ret parameter, which is used for redirecting URL requests.

Recommendations For WebCalendar version 1.0.1, consider restricting access to the layers toggle.php file until a patch is available, or avoid using the ret parameter in the affected URL requests to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-3982

DSA-1002-1

Produtos afetados

Webcalendar

Referências · 10

• 🔥 https://exploit-db.com/exploits/26691 · Exploit
• http://securityfocus.com/archive/1/418286/100/0/threaded · Nota
• http://secunia.com/advisories/19240 · Aviso do Fabricante
• http://secunia.com/advisories/17848 · Aviso do Fabricante
• http://vd.lwang.org/webcalendar_multiple_vulns.txt · Nota
• http://vupen.com/english/advisories/2005/2702 · Nota
• http://debian.org/security/2006/dsa-1002 · Aviso do Fabricante
• http://osvdb.org/21383 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3982 · Nota de Segurança
• http://securityfocus.com/bid/15673 · Nota