PT-2014-2313

CVE-2012-5486

Publicado

2014-09-16

Atualizado

2023-02-13

Descrição por

CVSS 4.0

8.7

Alta

MétricasAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zope versions prior to 2.13.19 Plone versions prior to 4.3 beta 1

Description The issue allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character in the ZPublisher.HTTPRequest. scrubHeader function.

Recommendations For Zope versions prior to 2.13.19, update to version 2.13.19 or later. For Plone versions prior to 4.3 beta 1, update to version 4.3 beta 1 or later.

Explorabilidade

Correção

Pesquisadores

David Glick

Davisagli

Fornecedores

Produtos afetados

Identificadores relacionados

CVE-2012-5486

GHSA-77HV-8796-8CCP

PYSEC-2014-28

PYSEC-2014-73