VulnerabilityModified
CVE-2005-3348
HTTP response splitting vulnerability in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egroupware before 1.0.0.009, allows remote attackers to spoof web content and poison web caches via CRLF sequences in the…
MEDIUM 4.3EPSS 1.98%
Does this matter?
Lower severity and a low EPSS score (1.98%). Track it; it rarely justifies an emergency change on its own.
Description
HTTP response splitting vulnerability in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egroupware before 1.0.0.009, allows remote attackers to spoof web content and poison web caches via CRLF sequences in the charset parameter.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 1.98% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- phpsysinfo/phpsysinfo
- Source
- security@debian.org
References
- http://secunia.com/advisories/17441
- http://secunia.com/advisories/17570
- http://secunia.com/advisories/17584
- http://secunia.com/advisories/17616
- http://secunia.com/advisories/17620
- http://secunia.com/advisories/17643
- http://secunia.com/advisories/17698
- http://www.debian.org/security/2005/dsa-897
- http://www.debian.org/security/2005/dsa-898Patch, Vendor Advisory
- http://www.debian.org/security/2005/dsa-899
- http://www.gentoo.org/security/en/glsa/glsa-200511-18.xml
- http://www.hardened-php.net/advisory_212005.81.html
- http://www.mandriva.com/security/advisories?name=MDKSA-2005:212
- http://www.securityfocus.com/archive/1/416543
- http://www.securityfocus.com/bid/15396
- http://www.securityfocus.com/bid/15414
- https://exchange.xforce.ibmcloud.com/vulnerabilities/23107
- http://secunia.com/advisories/17441
- http://secunia.com/advisories/17570
- http://secunia.com/advisories/17584
- http://secunia.com/advisories/17616
- http://secunia.com/advisories/17620
- http://secunia.com/advisories/17643
- http://secunia.com/advisories/17698
- http://www.debian.org/security/2005/dsa-897
- http://www.debian.org/security/2005/dsa-898Patch, Vendor Advisory
- http://www.debian.org/security/2005/dsa-899
- http://www.gentoo.org/security/en/glsa/glsa-200511-18.xml
- http://www.hardened-php.net/advisory_212005.81.html
- http://www.mandriva.com/security/advisories?name=MDKSA-2005:212
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.