PT-2018-10045

CVE-2018-1067

Publicado

2018-05-21

Atualizado

2022-05-13

Descrição por

CVSS 3.1

6.1

Média

MétricasAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Undertow versions prior to 7.1.2.CR1 Undertow versions prior to 7.1.2.GA

Description The issue is related to insufficient sanitization and validation of user input before it is used as part of an HTTP header value, allowing the injection of arbitrary HTTP headers and response splitting.

Recommendations For versions prior to 7.1.2.CR1, update to version 7.1.2.CR1 or later. For versions prior to 7.1.2.GA, update to version 7.1.2.GA or later.

Explorabilidade

Correção

Impactos

Pesquisadores

Ammarit Thongthua

Laura Pardo

Nattakit Intarasorn

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\'HTTP Request/Response Splitting\')

Identificadores relacionados