Lucene search

[email protected]NVD:CVE-2015-2156

HistoryOct 18, 2017 - 3:29 p.m.

CVE-2015-2156

2017-10-1815:29:00

CWE-20

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.7

Confidence

High

EPSS

0.006

Percentile

77.8%

JSON

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.

Affected configurations

Nvd

Node

nettynettyRange≤3.9.7

nettynettyMatch3.10.0

nettynettyMatch3.10.1

nettynettyMatch3.10.2

nettynettyMatch4.0.0

nettynettyMatch4.0.1

nettynettyMatch4.0.2

nettynettyMatch4.0.3

nettynettyMatch4.0.4

nettynettyMatch4.0.5

nettynettyMatch4.0.6

nettynettyMatch4.0.7

nettynettyMatch4.0.8

nettynettyMatch4.0.9

nettynettyMatch4.0.10

nettynettyMatch4.0.11

nettynettyMatch4.0.12

nettynettyMatch4.0.13

nettynettyMatch4.0.14

nettynettyMatch4.0.15

nettynettyMatch4.0.16

nettynettyMatch4.0.17

nettynettyMatch4.0.18

nettynettyMatch4.0.19

nettynettyMatch4.0.20

nettynettyMatch4.0.21

nettynettyMatch4.0.22

nettynettyMatch4.0.23

nettynettyMatch4.0.24

nettynettyMatch4.0.25

nettynettyMatch4.0.26

nettynettyMatch4.0.27

nettynettyMatch4.1.0beta1

nettynettyMatch4.1.0beta2

nettynettyMatch4.1.0beta3

nettynettyMatch4.1.0beta4

Node

lightbendplay_frameworkMatch2.0rc3

lightbendplay_frameworkMatch2.0rc4

lightbendplay_frameworkMatch2.0rc5

lightbendplay_frameworkMatch2.0.2

lightbendplay_frameworkMatch2.0.2rc1

lightbendplay_frameworkMatch2.0.2rc2

lightbendplay_frameworkMatch2.0.3

lightbendplay_frameworkMatch2.0.3rc1

lightbendplay_frameworkMatch2.0.3rc2

lightbendplay_frameworkMatch2.0.4

lightbendplay_frameworkMatch2.0.4rc1

lightbendplay_frameworkMatch2.0.4rc2

lightbendplay_frameworkMatch2.0.5

lightbendplay_frameworkMatch2.0.5rc1

lightbendplay_frameworkMatch2.0.5rc2

lightbendplay_frameworkMatch2.0.6

lightbendplay_frameworkMatch2.0.7

lightbendplay_frameworkMatch2.0.8

lightbendplay_frameworkMatch2.1.0

lightbendplay_frameworkMatch2.1.1

lightbendplay_frameworkMatch2.1.1rc1

lightbendplay_frameworkMatch2.2.0

lightbendplay_frameworkMatch2.2.1

lightbendplay_frameworkMatch2.2.2

lightbendplay_frameworkMatch2.2.6

lightbendplay_frameworkMatch2.3.0

lightbendplay_frameworkMatch2.3.0rc1

lightbendplay_frameworkMatch2.3.0rc2

lightbendplay_frameworkMatch2.3.1

lightbendplay_frameworkMatch2.3.2

lightbendplay_frameworkMatch2.3.2rc1

lightbendplay_frameworkMatch2.3.2rc2

lightbendplay_frameworkMatch2.3.3

lightbendplay_frameworkMatch2.3.4

lightbendplay_frameworkMatch2.3.5

lightbendplay_frameworkMatch2.3.6

lightbendplay_frameworkMatch2.3.7

lightbendplay_frameworkMatch2.3.8

playframeworkplay_frameworkMatch2.0

playframeworkplay_frameworkMatch2.0beta

playframeworkplay_frameworkMatch2.0rc1

playframeworkplay_frameworkMatch2.0rc2

playframeworkplay_frameworkMatch2.0.1

playframeworkplay_frameworkMatch2.1.12.9.x-backport

playframeworkplay_frameworkMatch2.1.1rc1-2.9.x-backport

playframeworkplay_frameworkMatch2.1.1rc2

playframeworkplay_frameworkMatch2.1.2

playframeworkplay_frameworkMatch2.1.2rc1

playframeworkplay_frameworkMatch2.1.2rc2

playframeworkplay_frameworkMatch2.1.3

playframeworkplay_frameworkMatch2.1.3rc1

playframeworkplay_frameworkMatch2.1.3rc2

playframeworkplay_frameworkMatch2.1.4

playframeworkplay_frameworkMatch2.1.4rc1

playframeworkplay_frameworkMatch2.1.4rc2

playframeworkplay_frameworkMatch2.1.5

playframeworkplay_frameworkMatch2.1.6

playframeworkplay_frameworkMatch2.1.6rc1

playframeworkplay_frameworkMatch2.2.0m1

playframeworkplay_frameworkMatch2.2.0m2

playframeworkplay_frameworkMatch2.2.0m3

playframeworkplay_frameworkMatch2.2.0rc1

playframeworkplay_frameworkMatch2.2.0rc2

playframeworkplay_frameworkMatch2.2.1rc1

playframeworkplay_frameworkMatch2.2.2rc1

playframeworkplay_frameworkMatch2.2.2rc2

playframeworkplay_frameworkMatch2.2.2rc3

playframeworkplay_frameworkMatch2.2.2rc4

playframeworkplay_frameworkMatch2.2.3

playframeworkplay_frameworkMatch2.2.3rc1

playframeworkplay_frameworkMatch2.2.3rc2

playframeworkplay_frameworkMatch2.2.4

playframeworkplay_frameworkMatch2.2.5

playframeworkplay_frameworkMatch2.3m1

VendorProductVersionCPE
nettynetty*cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*
nettynetty3.10.0cpe:2.3:a:netty:netty:3.10.0:*:*:*:*:*:*:*
nettynetty3.10.1cpe:2.3:a:netty:netty:3.10.1:*:*:*:*:*:*:*
nettynetty3.10.2cpe:2.3:a:netty:netty:3.10.2:*:*:*:*:*:*:*
nettynetty4.0.0cpe:2.3:a:netty:netty:4.0.0:*:*:*:*:*:*:*
nettynetty4.0.1cpe:2.3:a:netty:netty:4.0.1:*:*:*:*:*:*:*
nettynetty4.0.2cpe:2.3:a:netty:netty:4.0.2:*:*:*:*:*:*:*
nettynetty4.0.3cpe:2.3:a:netty:netty:4.0.3:*:*:*:*:*:*:*
nettynetty4.0.4cpe:2.3:a:netty:netty:4.0.4:*:*:*:*:*:*:*
nettynetty4.0.5cpe:2.3:a:netty:netty:4.0.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
netty	netty	*	cpe:2.3:a:netty:netty::::::::
netty	netty	3.10.0	cpe:2.3:a:netty:netty:3.10.0:::::::*
netty	netty	3.10.1	cpe:2.3:a:netty:netty:3.10.1:::::::*
netty	netty	3.10.2	cpe:2.3:a:netty:netty:3.10.2:::::::*
netty	netty	4.0.0	cpe:2.3:a:netty:netty:4.0.0:::::::*
netty	netty	4.0.1	cpe:2.3:a:netty:netty:4.0.1:::::::*
netty	netty	4.0.2	cpe:2.3:a:netty:netty:4.0.2:::::::*
netty	netty	4.0.3	cpe:2.3:a:netty:netty:4.0.3:::::::*
netty	netty	4.0.4	cpe:2.3:a:netty:netty:4.0.4:::::::*
netty	netty	4.0.5	cpe:2.3:a:netty:netty:4.0.5:::::::*