CVE-2015-5245

CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://tracker.ceph.com/issues/12537
https://access.redhat.com/errata/RHSA-2015:2512
http://lists.ceph.com/pipermail/ceph-announce-ceph.com/2015-October/000034.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:ceph:*:*:*:*:*:*:*:*

Information

Published : 2015-12-03 12:59

Updated : 2023-02-12 16:52

NVD link : CVE-2015-5245

Mitre link : CVE-2015-5245

JSON object : View

CWE

NVD-CWE-Other

Products Affected

redhat

ceph

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://tracker.ceph.com/issues/12537", "name": "http://tracker.ceph.com/issues/12537", "tags": [], "refsource": "CONFIRM"}, {"url": "https://access.redhat.com/errata/RHSA-2015:2512", "name": "RHSA-2015:2512", "tags": [], "refsource": "REDHAT"}, {"url": "http://lists.ceph.com/pipermail/ceph-announce-ceph.com/2015-October/000034.html", "name": "[Ceph-announce] 20151019 v0.94.4 Hammer released", "tags": ["Vendor Advisory"], "refsource": "MLIST"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2015-5245", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2015-12-03T20:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:ceph:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "0.94.3"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-02-13T00:52Z"}

4.3 /10