Design/Logic Flaw

All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and addCookie functions. An attacker can add the \r\n carriage return line feeds characters to end the HTTP response headers and...

CVE-2023-26138

The CVE-2023-26138 entry concerns drogonframework/drogon with a CRLF Injection vulnerability in the addHeader function. Untrusted user input used to set request headers can insert \r\n characters, enabling injection of additional headers into outgoing requests. Several sources (NVD, Red Hat, PRio...

Drogon 环境问题漏洞

Drogon is an open source HTTP application framework based on C++14/17. Drogon can be used to easily build various types of web application server programs using C++. Drogon is vulnerable to an environmental issue that stems from an HTTP response splitting problem that allows an attacker to add th...

PT-2023-20515 · Drogon · Drogon

Name of the Vulnerable Software and Affected Versions: drogonframework/drogon affected versions not specified Description: The issue arises when untrusted user input is used to build header values in the addHeader and addCookie functions, allowing an attacker to inject malicious content by adding...

PT-2023-20516 · Unknown · Drogonframework/Drogon

Name of the Vulnerable Software and Affected Versions: drogonframework/drogon versions prior to the fixed version Description: The issue arises when untrusted user input is used to set request headers in the addHeader function, allowing an attacker to inject additional headers by adding r carriag...

Drogon 注入漏洞

Drogon is an open source HTTP application framework based on C++14/17. Drogon can be used to easily build various types of web application server programs using C++. A security vulnerability exists in Drogon that stems from a CRLF injection issue that allows an attacker to add rn characters and...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection when untrusted user input is used to set request headers in the addHeader function. An attacker can add the \r\n carriage return line feeds characters and inject additional headers in the request sent. Remediation There i...

HTTP Response Splitting

Overview Affected versions of this package are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and addCookie functions. An attacker can add the \r\n carriage return line feeds characters to end the HTTP response headers and inject...

CVE-2022-3959

A vulnerability, which was classified as problematic, has been found in drogon up to 1.8.1. Affected by this issue is some unknown functionality of the component Session Hash Handler. The manipulation leads to small space of random values. The attack may be launched remotely. Upgrading to version...

Design/Logic Flaw

A vulnerability, which was classified as problematic, has been found in drogon up to 1.8.1. Affected by this issue is some unknown functionality of the component Session Hash Handler. The manipulation leads to small space of random values. The attack may be launched remotely. Upgrading to version...

PT-2022-24981 · Drogon · Drogon

Name of the Vulnerable Software and Affected Versions: drogon versions up to 1.8.1 Description: A problematic issue has been found in the Session Hash Handler component, allowing for remote attacks that lead to a small space of random values. The estimated number of potentially affected devices i...

CVE-2022-3959 drogon Session Hash small space of random values

A vulnerability, which was classified as problematic, has been found in drogon up to 1.8.1. Affected by this issue is some unknown functionality of the component Session Hash Handler. The manipulation leads to small space of random values. The attack may be launched remotely. Upgrading to version...

CVE-2022-3959 drogon Session Hash small space of random values

A vulnerability, which was classified as problematic, has been found in drogon up to 1.8.1. Affected by this issue is some unknown functionality of the component Session Hash Handler. The manipulation leads to small space of random values. The attack may be launched remotely. Upgrading to version...

Drogon 安全特征问题漏洞

Drogon is an open source HTTP application framework based on C++14/17.Drogon can be used to easily build various types of web application server programs using C++. A security vulnerability exists in Drogon 1.8.1 and earlier versions that stems from an unknown feature of the Session Hash componen...

CVE-2022-3959

CVE-2022-3959 affects Drogon up to version 1.8.1, where a vulnerability in the Session Hash Handler enables remote exploitation by manipulating an unknown functionality and producing a small space of random values. Remediation is to upgrade to version 1.8.2, with the patch identified as c0d48da99...

CVE-2022-3959 drogon Session Hash small space of random values

A vulnerability, which was classified as problematic, has been found in drogon up to 1.8.1. Affected by this issue is some unknown functionality of the component Session Hash Handler. The manipulation leads to small space of random values. The attack may be launched remotely. Upgrading to version...

Drogon Access Control Error Vulnerability

Drogon is an open source HTTP application framework based on C 14/17. Drogon can be used to easily build various types of web application server programs using C. An access control error vulnerability exists in the Drogon framework, which stems from the product's HttpFile::save method not...

CVE-2022-25297

CVE-2022-25297 affects the Drogon framework (drogon) before 1.7.5. The vulnerability arises from unsafe handling of file names during uploads in HttpFile::save(), allowing an attacker to write files to arbitrary locations outside the target directory. Impact is partial to high depending on contex...

CVE-2022-25297 Arbitrary File Write

This affects the package drogonframework/drogon before 1.7.5. The unsafe handling of file names during upload using HttpFile::save method may enable attackers to write files to arbitrary locations outside the designated target folder...

CVE-2022-25297

This affects the package drogonframework/drogon before 1.7.5. The unsafe handling of file names during upload using HttpFile::save method may enable attackers to write files to arbitrary locations outside the designated target folder...