CVE-2009-1149

2009-03-2614:30:00

CWE-20

mitre

web.nvd.nist.gov

cve

2009

phpmyadmin

crlf

injection

vulnerability

http headers

response splitting

attack

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.4

Confidence

High

EPSS

0.011

Percentile

84.6%

JSON

CRLF injection vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the (1) c_type and possibly (2) file_type parameters.

Affected configurations

Nvd

Node

phpmyadminphpmyadminRange≤3.1.3

phpmyadminphpmyadminMatch3.1.0

phpmyadminphpmyadminMatch3.1.0.0

phpmyadminphpmyadminMatch3.1.1

phpmyadminphpmyadminMatch3.1.1rc1

phpmyadminphpmyadminMatch3.1.2

phpmyadminphpmyadminMatch3.1.2rc1

phpmyadminphpmyadminMatch3.1.3rc1

VendorProductVersionCPE
phpmyadminphpmyadmin*cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*
phpmyadminphpmyadmin3.1.0cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*
phpmyadminphpmyadmin3.1.0.0cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0.0:*:*:*:*:*:*:*
phpmyadminphpmyadmin3.1.1cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*
phpmyadminphpmyadmin3.1.1cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*
phpmyadminphpmyadmin3.1.2cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*
phpmyadminphpmyadmin3.1.2cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*
phpmyadminphpmyadmin3.1.3cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*

Vendor	Product	Version	CPE
phpmyadmin	phpmyadmin	*	cpe:2.3:a:phpmyadmin:phpmyadmin::::::::
phpmyadmin	phpmyadmin	3.1.0	cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:::::::*
phpmyadmin	phpmyadmin	3.1.0.0	cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0.0:::::::*
phpmyadmin	phpmyadmin	3.1.1	cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:::::::*
phpmyadmin	phpmyadmin	3.1.1	cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1::::::
phpmyadmin	phpmyadmin	3.1.2	cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:::::::*
phpmyadmin	phpmyadmin	3.1.2	cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1::::::
phpmyadmin	phpmyadmin	3.1.3	cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1::::::