CVE-2005-3982

CRLF injection vulnerability in layers_toggle.php in WebCalendar 1.0.1 might allow remote attackers to modify HTTP headers and conduct HTTP response splitting attacks via the ret parameter, which is used to redirect URL requests.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://vd.lwang.org/webcalendar_multiple_vulns.txt
http://www.securityfocus.com/bid/15673
http://secunia.com/advisories/17848	Patch Vendor Advisory
http://www.osvdb.org/21383
http://www.debian.org/security/2006/dsa-1002	Patch Vendor Advisory
http://secunia.com/advisories/19240	Patch Vendor Advisory
http://www.vupen.com/english/advisories/2005/2702
http://www.securityfocus.com/archive/1/418286/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:webcalendar:webcalendar:1.0.1:*:*:*:*:*:*:*

Information

Published : 2005-12-04 03:03

Updated : 2018-10-19 08:39

NVD link : CVE-2005-3982

Mitre link : CVE-2005-3982

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

webcalendar

webcalendar

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://vd.lwang.org/webcalendar_multiple_vulns.txt", "name": "http://vd.lwang.org/webcalendar_multiple_vulns.txt", "tags": [], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/15673", "name": "15673", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/17848", "name": "17848", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.osvdb.org/21383", "name": "21383", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.debian.org/security/2006/dsa-1002", "name": "DSA-1002", "tags": ["Patch", "Vendor Advisory"], "refsource": "DEBIAN"}, {"url": "http://secunia.com/advisories/19240", "name": "19240", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.vupen.com/english/advisories/2005/2702", "name": "ADV-2005-2702", "tags": [], "refsource": "VUPEN"}, {"url": "http://www.securityfocus.com/archive/1/418286/100/0/threaded", "name": "20051201 WebCalendar Multiple Vulnerabilities.", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "CRLF injection vulnerability in layers_toggle.php in WebCalendar 1.0.1 might allow remote attackers to modify HTTP headers and conduct HTTP response splitting attacks via the ret parameter, which is used to redirect URL requests."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2005-3982", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2005-12-04T11:03Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:webcalendar:webcalendar:1.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-19T15:39Z"}