CVE-2009-1594
Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, does not properly implement the "positive model," which allows remote attackers to bypass certain protection mechanisms via a %0A (encoded newline), as demonstrated by a…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, does not properly implement the "positive model," which allows remote attackers to bypass certain protection mechanisms via a %0A (encoded newline), as demonstrated by a %0A in a cross-site scripting (XSS) attack URL.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 1.45% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- armorlogic/profense web application firewall
- Source
- cve@mitre.org
References
- http://resources.enablesecurity.com/advisories/ES-20090500-profense.txt
- http://www.securityfocus.com/archive/1/503649/100/0/threaded
- http://www.securityfocus.com/bid/35053
- http://www.webappsec.org/lists/websecurity/archive/2009-05/msg00040.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50662
- http://resources.enablesecurity.com/advisories/ES-20090500-profense.txt
- http://www.securityfocus.com/archive/1/503649/100/0/threaded
- http://www.securityfocus.com/bid/35053
- http://www.webappsec.org/lists/websecurity/archive/2009-05/msg00040.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50662
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.