PT-2005-4720 · Unknown · Webcalendar

Published 2005-12-04 · Updated 2018-10-19 · CVE-2005-3982

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WebCalendar version 1.0.1

Description A CRLF injection issue exists, potentially allowing remote attackers to modify HTTP headers and conduct HTTP response splitting attacks. This is achieved via the ret parameter, which is used for redirecting URL requests.

Recommendations For WebCalendar version 1.0.1, consider restricting access to the layers toggle.php file until a patch is available, or avoid using the ret parameter in the affected URL requests to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-3982

DSA-1002-1

Affected Products

Webcalendar

References · 10

• 🔥 https://exploit-db.com/exploits/26691 · Exploit
• http://secunia.com/advisories/19240 · Vendor Advisory
• http://secunia.com/advisories/17848 · Vendor Advisory
• http://debian.org/security/2006/dsa-1002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3982 · Security Note
• http://securityfocus.com/archive/1/418286/100/0/threaded · Note
• http://vd.lwang.org/webcalendar_multiple_vulns.txt · Note
• http://vupen.com/english/advisories/2005/2702 · Note
• http://osvdb.org/21383 · Note
• http://securityfocus.com/bid/15673 · Note