PT-2018-11670 · Apache · Apache Allura

Published 2018-03-15 · Updated 2020-08-24 · CVE-2018-1319

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Allura versions prior to 1.8.1

Description The issue allows attackers to craft URLs that cause HTTP response splitting. If a victim visits a maliciously crafted URL, it may lead to unwanted results, including cross-site scripting (XSS) or service denial for the victim's browsing session.

Recommendations For versions prior to 1.8.1, update to version 1.8.1 or later to resolve the issue.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2018-1319

Affected Products

Apache Allura

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-1319 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1319 · Vendor Advisory
• https://lists.apache.org/thread.html/22b74bc4002091157ec2bddf9fa3b7643ffaa77aa6cb85562f0e30da%40%3Cdev.allura.apache.org%3E · Note
• http://securityfocus.com/bid/103434 · Note