CVE Vulnerability

CVE-2007-2550

Multiple CRLF injection vulnerabilities in Devellion CubeCart 3.0.15 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a cookie name beginning with "ccSID" to (1) cart.php or (2) index.php.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

References
Link Resource
http://www.securityfocus.com/bid/23852
http://www.cubecart.com/site/forums/index.php?s=0cbaa8a2f26fc573d1fc888285f610b1&showtopic=27418
http://securityreason.com/securityalert/2678
http://osvdb.org/36210
http://osvdb.org/36209
https://exchange.xforce.ibmcloud.com/vulnerabilities/34141
http://www.securityfocus.com/archive/1/468053/100/0/threaded
http://www.securityfocus.com/archive/1/467828/100/0/threaded
Configurations

Configuration 1

cpe:2.3:a:devellion:cubecart:3.0.15:*:*:*:*:*:*:*
Information

Published : 2007-05-09 10:19

Updated : 2018-10-16 04:44

NVD link : CVE-2007-2550

Mitre link : CVE-2007-2550

Products Affected
No products.
CWE
NVD-CWE-Other