Vulnerability CVE-2020-12855

Vulnerability CVE-2020-12855

Published: 2020-08-26

Description:

A Host header injection vulnerability has been discovered in SecZetta NEProfile 3.3.11. Authenticated remote adversaries can poison this header resulting in an adversary controlling the execution flow for the 302 HTTP status.

See advisories in our WLB2 database:

	Topic	Author	Date
Low	SecZetta NEProfile 3.3.11 Host Header Injection	Josh Sheppard	25.08.2020

Type:

CWE-74

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
6.5/10	6.4/10	8/10

Exploit range	Attack complexity	Authentication
Remote	Low	Single time
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
Seczetta -> Neprofile

References:

http://packetstormsecurity.com/files/158965/SecZetta-NEProfile-3.3.11-Host-Header-Injection.html

Copyright 2024, cxsecurity.com