CVE-2004-1620

Description

CRLF injection vulnerability in Serendipity before 0.7rc1 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the url parameter in (1) index.php and (2) exit.php, or (3) the HTTP Referer field in comment.php.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/17798

http://www.osvdb.org/11039

http://www.osvdb.org/11038

http://www.osvdb.org/11013

http://sourceforge.net/project/shownotes.php?release_id=276694

http://securitytracker.com/id?1011864

http://marc.info/?l=bugtraq&m=109841283115808&w=2

http://cvs.sourceforge.net/viewcvs.py/php-blog/serendipity/index.php?rev=1.52&view=markup

http://cvs.sourceforge.net/viewcvs.py/php-blog/serendipity/exit.php?rev=1.10&view=markup

http://cvs.sourceforge.net/viewcvs.py/php-blog/serendipity/comment.php?rev=1.49&view=markup

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3