6.1

CVE-2016-5699

Exploit
CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Python ≫ Python Version <= 2.7.9
Python ≫ Python Version3.0
Python ≫ Python Version3.0.1
Python ≫ Python Version3.1.0
Python ≫ Python Version3.1.1
Python ≫ Python Version3.1.2
Python ≫ Python Version3.1.3
Python ≫ Python Version3.1.4
Python ≫ Python Version3.1.5
Python ≫ Python Version3.2.0
Python ≫ Python Version3.2.1
Python ≫ Python Version3.2.2
Python ≫ Python Version3.2.3
Python ≫ Python Version3.2.4
Python ≫ Python Version3.2.5
Python ≫ Python Version3.2.6
Python ≫ Python Version3.3.0
Python ≫ Python Version3.3.1
Python ≫ Python Version3.3.2
Python ≫ Python Version3.3.3
Python ≫ Python Version3.3.4
Python ≫ Python Version3.3.5
Python ≫ Python Version3.3.6
Python ≫ Python Version3.4.0
Python ≫ Python Version3.4.1
Python ≫ Python Version3.4.2
Python ≫ Python Version3.4.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 27.66% 0.962
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.