4.3

CVE-2005-3348

HTTP response splitting vulnerability in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egroupware before 1.0.0.009, allows remote attackers to spoof web content and poison web caches via CRLF sequences in the charset parameter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Phpsysinfo ≫ Phpsysinfo Version2.0
Phpsysinfo ≫ Phpsysinfo Version2.1
Phpsysinfo ≫ Phpsysinfo Version2.3
Phpsysinfo ≫ Phpsysinfo Version2.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.98% 0.779
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

http://secunia.com/advisories/17616
http://secunia.com/advisories/17643
http://www.debian.org/security/2005/dsa-897
http://www.debian.org/security/2005/dsa-898
Patch
Vendor Advisory
http://www.debian.org/security/2005/dsa-899
http://www.mandriva.com/security/advisories?name=MDKSA-2005:212
http://www.securityfocus.com/archive/1/416543
http://www.securityfocus.com/bid/15414
http://secunia.com/advisories/17441
http://secunia.com/advisories/17570
http://secunia.com/advisories/17584
http://secunia.com/advisories/17620
http://secunia.com/advisories/17698
http://www.gentoo.org/security/en/glsa/glsa-200511-18.xml
http://www.hardened-php.net/advisory_212005.81.html
http://www.securityfocus.com/bid/15396
https://exchange.xforce.ibmcloud.com/vulnerabilities/23107