PT-2008-1847 · Ellislab · Expressionengine

Publicado 2008-01-10 · Atualizado 2018-10-15 · CVE-2008-0202

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ExpressionEngine versions 1.2.1 and earlier

Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the URL parameter.

Recommendations For ExpressionEngine versions 1.2.1 and earlier, update to a version later than 1.2.1 to resolve the issue.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-0202

Produtos afetados

Expressionengine

Referências · 8

• http://securityfocus.com/bid/27128 · Nota
• http://websecurity.com.ua/1454 · Nota
• http://securityfocus.com/archive/1/485786/100/0/threaded · Nota
• http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0202 · Nota
• http://securityvulns.ru/Sdocument472.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0202 · Nota de Segurança
• http://securityreason.com/securityalert/3539 · Nota