CVE-2006-3105

CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple unspecified parameters that are injected into HTTP headers, as demonstrated by the BWSESSION parameter in index.php.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://retrogod.altervista.org/bitweaver_13_xpl.html	Exploit
http://sourceforge.net/project/shownotes.php?release_id=336854&group_id=141358
http://www.bitweaver.org/articles/45
http://www.osvdb.org/26590
http://securityreason.com/securityalert/1115
https://exchange.xforce.ibmcloud.com/vulnerabilities/27348
http://www.securityfocus.com/archive/1/437491/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:bitweaver:bitweaver:1.3:*:*:*:*:*:*:*

Information

Published : 2006-06-20 18:02

Updated : 2018-10-18 09:45

NVD link : CVE-2006-3105

Mitre link : CVE-2006-3105

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

bitweaver

bitweaver

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://retrogod.altervista.org/bitweaver_13_xpl.html", "name": "http://retrogod.altervista.org/bitweaver_13_xpl.html", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://sourceforge.net/project/shownotes.php?release_id=336854&group_id=141358", "name": "http://sourceforge.net/project/shownotes.php?release_id=336854&group_id=141358", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.bitweaver.org/articles/45", "name": "http://www.bitweaver.org/articles/45", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.osvdb.org/26590", "name": "26590", "tags": [], "refsource": "OSVDB"}, {"url": "http://securityreason.com/securityalert/1115", "name": "1115", "tags": [], "refsource": "SREASON"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27348", "name": "bitweaver-crlf-header-injection(27348)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/437491/100/0/threaded", "name": "20060617 bitweaver <= v1.3 multiple vulnerabilities", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple unspecified parameters that are injected into HTTP headers, as demonstrated by the BWSESSION parameter in index.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-3105", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2006-06-21T01:02Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:bitweaver:bitweaver:1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-18T16:45Z"}