GitHub_MCVELIST:CVE-2019-16771CVE-2019-16771 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Armeria
4.8 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
6.6 Medium
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
53.4%
Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response. This vulnerability has been patched in 0.97.0. Potential impacts of this vulnerability include cross-user defacement, cache poisoning, Cross-site scripting (XSS), and page hijacking.
CNA Affected
[
{
"product": "Armeria",
"vendor": "LINE",
"versions": [
{
"lessThan": "0.97.0",
"status": "affected",
"version": "< 0.97.0",
"versionType": "custom"
}
]
}
]Related
4.8 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
6.6 Medium
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
53.4%