CVE-2019-19326

Silverstripe CMS sites through 4.4.4 which have opted into HTTP Cache Headers on responses served by the framework's HTTP layer can be vulnerable to web cache poisoning. Through modifying the X-Original-Url and X-HTTP-Method-Override headers, responses with malicious HTTP headers can return unexpected responses to other consumers of this cached response. Most other headers associated with web cache poisoning are already disabled through request hostname forgery whitelists.

CVSS v3 5.9 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://www.silverstripe.org/download/security-releases/CVE-2019-19326	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:silverstripe:silverstripe::::::::
	cpe:2.3:a:silverstripe:silverstripe::::::::
	cpe:2.3:a:silverstripe:silverstripe::::::::

History

No history.

Information

Published : 2020-07-15 19:15

Updated : 2023-12-10 13:27

NVD link : CVE-2019-19326

Mitre link : CVE-2019-19326

CVE.ORG link : CVE-2019-19326

JSON object : View

Products Affected

silverstripe

silverstripe

CWE

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

{"id": "CVE-2019-19326", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2020-07-15T19:15:11.180", "references": [{"url": "https://www.silverstripe.org/download/security-releases/CVE-2019-19326", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "Silverstripe CMS sites through 4.4.4 which have opted into HTTP Cache Headers on responses served by the framework's HTTP layer can be vulnerable to web cache poisoning. Through modifying the X-Original-Url and X-HTTP-Method-Override headers, responses with malicious HTTP headers can return unexpected responses to other consumers of this cached response. Most other headers associated with web cache poisoning are already disabled through request hostname forgery whitelists."}, {"lang": "es", "value": "Los sitios de Silverstripe CMS versiones hasta 4.4.4 que han optado por Encabezados HTTP Cache en las respuestas atendidas por medio de la capa HTTP del framework pueden ser vulnerables al envenenamiento de la cach\u00e9 web. Mediante la modificaci\u00f3n de los encabezados X-Original-Url y X-HTTP-Method-Override, las respuestas con encabezados HTTP maliciosos pueden devolver respuestas inesperadas a otros consumidores de esta respuesta almacenada en cach\u00e9. La mayor\u00eda de los otros encabezados asociados con el envenenamiento de la cach\u00e9 web ya est\u00e1n deshabilitados por medio de las listas blancas de falsificaci\u00f3n del nombre de host de la petici\u00f3n"}], "lastModified": "2020-07-23T16:02:03.797", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:silverstripe:silverstripe:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7605240F-F74B-4190-B15A-D2B49C145B45", "versionEndExcluding": "3.7.5", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:silverstripe:silverstripe:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA2589F5-9B99-4DE2-96F0-F59D7F58987D", "versionEndExcluding": "4.4.7", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:silverstripe:silverstripe:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C4AD7A3-B9F1-463E-95D8-B47AF68463FE", "versionEndExcluding": "4.5.4", "versionStartIncluding": "4.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}