Description

ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

Remediation

References

CVE-2012-5486

Related Vulnerabilities

ownCloud Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-3833)

PHP Resource Management Errors Vulnerability (CVE-2014-3538)

WordPress Plugin Edwiser Bridge-WordPress Moodle LMS Integration Multiple Cross-Site Request Forgery Vulnerabilities (2.0.6)

WordPress Plugin WordPress Calls to Action Unspecified Vulnerability (2.3.1)

Oracle Database Server CVE-2010-0902 Vulnerability (CVE-2010-0902)

Severity

Medium

Classification

CVE-2012-5486

Tags

Missing Update Known Vulnerabilities