← Voltar para CVEs

CVE-2019-16771

MEDIUM

4.8

Descricao

Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response. This vulnerability has been patched in 0.97.0. Potential impacts of this vulnerability include cross-user defacement, cache poisoning, Cross-site scripting (XSS), and page hijacking.

Detalhes CVE

Pontuacao CVSS v3.14.8

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeHIGH

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado12/6/2019

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

linecorp:armeria

Fraquezas (CWE)

CWE-113CWE-74

Referencias

https://github.com/line/armeria/commit/b597f7a865a527a84ee3d6937075cfbb4470ed20(security-advisories@github.com)

https://github.com/line/armeria/security/advisories/GHSA-35fr-h7jr-hh86(security-advisories@github.com)

https://github.com/line/armeria/commit/b597f7a865a527a84ee3d6937075cfbb4470ed20(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/line/armeria/security/advisories/GHSA-35fr-h7jr-hh86(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.