Lucene search

VulDBCVE-2019-25101

HistoryFeb 04, 2023 - 8:15 a.m.

CVE-2019-25101

2023-02-0408:15:07

CWE-113

CWE-436

VulDB

web.nvd.nist.gov

cve-2019-25101

onshift turbogears

http header handler

remote attack

http response splitting

security patch

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.002

Percentile

64.5%

JSON

A vulnerability classified as critical has been found in OnShift TurboGears 1.0.11.10. This affects an unknown part of the file turbogears/controllers.py of the component HTTP Header Handler. The manipulation leads to http response splitting. It is possible to initiate the attack remotely. Upgrading to version 1.0.11.11 is able to address this issue. The patch is named f68bbaba47f4474e1da553aa51564a73e1d92a84. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220059.

Affected configurations

Nvd

Vulners

Node

turbogears_projectturbogearsMatch1.0.11.10

VendorProductVersionCPE
turbogears_projectturbogears1.0.11.10cpe:2.3:a:turbogears_project:turbogears:1.0.11.10:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
turbogears_project	turbogears	1.0.11.10	cpe:2.3:a:turbogears_project:turbogears:1.0.11.10:::::::*

CNA Affected

[
  {
    "vendor": "OnShift",
    "product": "TurboGears",
    "versions": [
      {
        "version": "1.0.11.10",
        "status": "affected"
      }
    ],
    "modules": [
      "HTTP Header Handler"
    ]
  }
]

References

github.com/OnShift/turbogears/commit/f68bbaba47f4474e1da553aa51564a73e1d92a84

github.com/OnShift/turbogears/pull/18

github.com/OnShift/turbogears/releases/tag/v1.0.11.11

vuldb.com/?ctiid.220059

vuldb.com/?id.220059

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.002

Percentile

64.5%

JSON

Related for CVE-2019-25101