CVE-2016-4993

medium

Description

CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1344321

https://access.redhat.com/errata/RHSA-2017:3458

https://access.redhat.com/errata/RHSA-2017:3456

https://access.redhat.com/errata/RHSA-2017:3455

https://access.redhat.com/errata/RHSA-2017:3454

http://www.securitytracker.com/id/1036758

http://www.securityfocus.com/bid/92894

http://rhn.redhat.com/errata/RHSA-2016-1841.html

http://rhn.redhat.com/errata/RHSA-2016-1840.html

http://rhn.redhat.com/errata/RHSA-2016-1839.html

http://rhn.redhat.com/errata/RHSA-2016-1838.html

Details

Source: Mitre, NVD

Published: 2016-09-26

Updated: 2017-12-15

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Severity: Medium