Lucene search

GitHub Advisory DatabaseGHSA-XV7R-9VQ4-9WRQ

HistorySep 15, 2022 - 12:00 a.m.

Project Wonder WebObjects vulnerable to Arbitrary HTTP Header Injection and Cross-site Scripting

2022-09-1500:00:17

CWE-79

GitHub Advisory Database

github.com

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

24.2%

JSON

Project Wonder WebObjects 1.0 through 7.3 is vulnerable to Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all web-server adaptor interfaces. A patch for this issue is available at commit number b0d2d74f13203268ea254b02552600850f28014b.

Affected configurations

Vulners

Node

github_advisory_databasewonder\Matchwonder

CPENameOperatorVersion
wonder:wonderge1.0
wonder:wonderle7.3

CPE	Name	Operator	Version
	wonder:wonder	ge	1.0
	wonder:wonder	le	7.3

References

github.com/advisories/GHSA-xv7r-9vq4-9wrq

github.com/wocommunity/wonder/commit/b0d2d74f13203268ea254b02552600850f28014b

github.com/wocommunity/wonder/pull/992

nvd.nist.gov/vuln/detail/CVE-2022-37724

xmit.xyz/security/webobjects-url-tomfoolery/

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

24.2%

JSON

Related for GHSA-XV7R-9VQ4-9WRQ