Description

Project Wonder WebObjects 1.0 through 5.4.3 is vulnerable to Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all web-server adaptor interfaces.

Remediation

References

https://github.com/wocommunity/wonder/pull/992

https://xmit.xyz/security/webobjects-url-tomfoolery/

Related Vulnerabilities

CVE-2020-27219 Vulnerability in maven package org.eclipse.hawkbit:hawkbit-update-server

CVE-2022-45400 Vulnerability in maven package org.jvnet.hudson.plugins:japex

CVE-2022-43426 Vulnerability in maven package io.jenkins.plugins:s3explorer

CVE-2021-21175 Vulnerability in maven package org.webjars.npm:electron

CVE-2021-21366 Vulnerability in npm package xmldom

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Patch Third Party Advisory Exploit Mitigation