Description
Project Wonder WebObjects 1.0 through 5.4.3 is vulnerable to Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all web-server adaptor interfaces.
Remediation
References
https://github.com/wocommunity/wonder/pull/992
https://xmit.xyz/security/webobjects-url-tomfoolery/
Related Vulnerabilities
CVE-2023-29215 Vulnerability in maven package org.apache.linkis:linkis-common
CVE-2022-24827 Vulnerability in maven package com.yahoo.elide:elide-datastore-aggregation
CVE-2022-34870 Vulnerability in maven package org.apache.geode:geode-pulse
CVE-2013-2160 Vulnerability in maven package org.apache.cxf:cxf-parent
CVE-2021-35516 Vulnerability in maven package org.apache.commons:commons-compress