Lucene search

[email protected]CVE-2007-2404

HistoryAug 03, 2007 - 10:17 a.m.

CVE-2007-2404

2007-08-0310:17:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2007-2404

crlf injection

cfnetwork

apple

mac os x

http response splitting

remote attackers

xss

nvd

5.8 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.008 Low

EPSS

Percentile

81.2%

JSON

CRLF injection vulnerability in CFNetwork on Apple Mac OS X 10.3.9 and 10.4.10 before 20070731 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in an unspecified context. NOTE: this can be leveraged for cross-site scripting (XSS) attacks.

CPENameOperatorVersion
apple:mac_os_xapple mac os xeq10.4.3
apple:mac_os_x_serverapple mac os x servereq10.4.3
apple:mac_os_x_serverapple mac os x servereq10.3.2
apple:mac_os_x_serverapple mac os x servereq10.4.10
apple:mac_os_x_serverapple mac os x servereq10.4.9
apple:mac_os_x_serverapple mac os x servereq10.3.7
apple:mac_os_x_serverapple mac os x servereq10.3.5
apple:mac_os_xapple mac os xeq10.3.1
apple:mac_os_xapple mac os xeq10.3.5
apple:mac_os_xapple mac os xeq10.4.1

CPE	Name	Operator	Version
apple:mac_os_x	apple mac os x	eq	10.4.3
apple:mac_os_x_server	apple mac os x server	eq	10.4.3
apple:mac_os_x_server	apple mac os x server	eq	10.3.2
apple:mac_os_x_server	apple mac os x server	eq	10.4.10
apple:mac_os_x_server	apple mac os x server	eq	10.4.9
apple:mac_os_x_server	apple mac os x server	eq	10.3.7
apple:mac_os_x_server	apple mac os x server	eq	10.3.5
apple:mac_os_x	apple mac os x	eq	10.3.1
apple:mac_os_x	apple mac os x	eq	10.3.5
apple:mac_os_x	apple mac os x	eq	10.4.1

Rows per page:

1-10 of 421

References

docs.info.apple.com/article.html?artnum=306172

lists.apple.com/archives/security-announce//2007/Jul/msg00004.html

secunia.com/advisories/26235

securitytracker.com/id?1018491

www.securityfocus.com/bid/25159

www.vupen.com/english/advisories/2007/2732

exchange.xforce.ibmcloud.com/vulnerabilities/35723

5.8 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.008 Low

EPSS

Percentile

81.2%

JSON

Related for CVE-2007-2404

prion1 nessus1 seebug1