Vulnerability CVE-2012-2965
Published: 2012-08-12

Description:
Caucho Quercus, as distributed in Resin before 4.0.29, does not properly handle unspecified characters in the names of variables, which has unknown impact and remote attack vectors, related to an "HTTP Parameter Contamination" issue.

Type:

CWE-20

 (Improper Input Validation)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Caucho -> Resin 

 References:
http://www.kb.cert.org/vuls/id/309979
http://en.securitylab.ru/lab/PT-2012-05
http://en.securitylab.ru/lab/
http://caucho.com/resin-4.0/changes/changes.xtp
Copyright 2024, cxsecurity.com

 

Back to Top