PT-2014-2313

CVE-2012-5486

Published

2014-09-16

Updated

2023-02-13

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zope versions prior to 2.13.19 Plone versions prior to 4.3 beta 1

Description The issue allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character in the ZPublisher.HTTPRequest. scrubHeader function.

Recommendations For Zope versions prior to 2.13.19, update to version 2.13.19 or later. For Plone versions prior to 4.3 beta 1, update to version 4.3 beta 1 or later.

Exploitability

Fix

Researchers

David Glick

Davisagli

Vendors

Affected products

Related identifiers

CVE-2012-5486

GHSA-77HV-8796-8CCP

PYSEC-2014-28

PYSEC-2014-73