CVE-2017-5615 - cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the re

CVE-2017-5615

Summary

cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location.

References

Vulnerable Configurations

cpe:2.3:a:cpanel:cgiecho:-:*:*:*:*:*:*:*
cpe:2.3:a:cpanel:cgiecho:-:*:*:*:*:*:*:*
cpe:2.3:a:cpanel:cgiemail:-:*:*:*:*:*:*:*
cpe:2.3:a:cpanel:cgiemail:-:*:*:*:*:*:*:*

CVSS

CWE

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:N

refmap via4

bid	95870
misc	https://news.cpanel.com/tsr-2017-0001-full-disclosure/
mlist	[oss-security] 20170128 Re: CVE request: cgiemail multiple vulnerabilities

Last major update

07-03-2017 - 13:34

Published

03-03-2017 - 15:59

Last modified

07-03-2017 - 13:34