CVE-2015-0733

CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks, via a crafted request, aka Bug ID CSCur25580.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://tools.cisco.com/security/center/viewAlert.x?alertId=38863	Vendor Advisory
http://www.securitytracker.com/id/1032445	Third Party Advisory VDB Entry
http://tools.cisco.com/security/center/viewAlert.x?alertId=38863	Vendor Advisory
http://www.securitytracker.com/id/1032445	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:o:cisco:headend_digital_broadband_delivery_system:-:*:*:*:*:*:*:*

History

21 Nov 2024, 02:23

Type	Values Removed	Values Added
References	~~() http://tools.cisco.com/security/center/viewAlert.x?alertId=38863 - Vendor Advisory~~	() http://tools.cisco.com/security/center/viewAlert.x?alertId=38863 - Vendor Advisory
References	~~() http://www.securitytracker.com/id/1032445 - Third Party Advisory, VDB Entry~~	() http://www.securitytracker.com/id/1032445 - Third Party Advisory, VDB Entry

Information

Published : 2015-05-30 14:59

Updated : 2024-11-21 02:23

NVD link : CVE-2015-0733

Mitre link : CVE-2015-0733

CVE.ORG link : CVE-2015-0733

JSON object : View

Products Affected

cisco

headend_digital_broadband_delivery_system

CWE

CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

{"id": "CVE-2015-0733", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2015-05-30T14:59:00.067", "references": [{"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=38863", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1032445", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=38863", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1032445", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-113"}]}], "descriptions": [{"lang": "en", "value": "CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks, via a crafted request, aka Bug ID CSCur25580."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n CRLF en HTTP Header Handler en Digital Broadband Delivery System en Cisco Headend System Release permite a atacantes remotos inyectar cabeceras HTTP arbitrarias, y realizar ataques de la divisi\u00f3n de respuestas HTTP o ataques de XSS, a trav\u00e9s de una solicitud manipulada, tambi\u00e9n conocido como Bug ID CSCur25580."}], "lastModified": "2024-11-21T02:23:37.267", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:headend_digital_broadband_delivery_system:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B751BEE-0C68-4C9C-A44E-E601A521F03C"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}