Vulnerability CVE-2005-3348
Published: 2005-11-17   Modified: 2012-02-12

Description:
HTTP response splitting vulnerability in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egroupware before 1.0.0.009, allows remote attackers to spoof web content and poison web caches via CRLF sequences in the charset parameter.

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Phpsysinfo -> Phpsysinfo 

 References:
http://www.debian.org/security/2005/dsa-898
http://xforce.iss.net/xforce/xfdb/23107
http://www.securityfocus.com/bid/15414
http://www.securityfocus.com/bid/15396
http://www.securityfocus.com/archive/1/416543
http://www.hardened-php.net/advisory_212005.81.html
http://www.gentoo.org/security/en/glsa/glsa-200511-18.xml
http://www.debian.org/security/2005/dsa-899
http://www.debian.org/security/2005/dsa-897
http://secunia.com/advisories/17698
http://secunia.com/advisories/17643
http://secunia.com/advisories/17620
http://secunia.com/advisories/17616
http://secunia.com/advisories/17584
http://secunia.com/advisories/17570
http://secunia.com/advisories/17441
http://www.mandriva.com/security/advisories?name=MDKSA-2005:212
Copyright 2024, cxsecurity.com

 

Back to Top