ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
13 Feb 2023, 04:36
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| Summary | ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character. |
02 Feb 2023, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | It was discovered that Plone, included as a part of luci, did not properly sanitize HTTP headers provided within certain URL requests. A remote attacker could use a specially crafted URL that, when processed, would cause the injected HTTP headers to be returned as a part of the Plone HTTP response, potentially allowing the attacker to perform other more advanced attacks. | |
| References |
|
Information
Published : 2014-09-30 14:55
Updated : 2023-12-10 11:31
NVD link : CVE-2012-5486
Mitre link : CVE-2012-5486
CVE.ORG link : CVE-2012-5486
JSON object : View
Products Affected
zope
- zope
plone
- plone
CWE