CVE-2021-43410 airavata-django-portal allows CRLF log injection because of the lack of escaping in the log statements

2021-12-0909:00:12

CWE-117

apache

www.cve.org

5.8 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.2%

JSON

Apache Airavata Django Portal allows CRLF log injection because of lack of escaping log statements. In particular, some HTTP request parameters are logged without first being escaped. Versions affected: master branch before commit 3c5d8c7 [1] of airavata-django-portal [1] https://github.com/apache/airavata-django-portal/commit/3c5d8c72bfc3eb0af8693a655a5d60f9273f8170

CNA Affected

[
  {
    "product": "Apache Airavata Django Portal",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "commit 3c5d8c7",
        "status": "affected",
        "version": "master branch",
        "versionType": "custom"
      }
    ]
  }
]

References

lists.apache.org/thread/q64h16ofdxk29soz3jj561nysnzcrl31