CVE-2004-2054

CRLF injection vulnerability in PhpBB 2.0.4 and 2.0.9 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via (1) the mode parameter to privmsg.php or (2) the redirect parameter to login.php.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://marc.info/?l=bugtraq&m=109034476122723&w=2
http://secunia.com/advisories/12114
http://www.securityfocus.com/bid/10753	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/16759

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:phpbb_group:phpbb:2.0.0:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.1:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.2:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.3:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.4:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.5:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.6:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.6c:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.6d:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.7:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.7a:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.8:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.8a:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.9:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0_beta1:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0_rc1:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0_rc2:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0_rc3:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0_rc4:::::::*

History

No history.

Information

Published : 2004-12-31 05:00

Updated : 2024-02-04 16:31

NVD link : CVE-2004-2054

Mitre link : CVE-2004-2054

CVE.ORG link : CVE-2004-2054

JSON object : View

Products Affected

phpbb_group

phpbb

CWE

NVD-CWE-Other

{"id": "CVE-2004-2054", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2004-12-31T05:00:00.000", "references": [{"url": "http://marc.info/?l=bugtraq&m=109034476122723&w=2", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/12114", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/10753", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16759", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "CRLF injection vulnerability in PhpBB 2.0.4 and 2.0.9 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via (1) the mode parameter to privmsg.php or (2) the redirect parameter to login.php."}], "lastModified": "2017-07-11T01:31:35.467", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E3B77B44-C3C9-4BC8-8D39-2200F1BACC07"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C74C78D-EEE0-48DF-9721-2A43B996EBD5"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "054EFBD3-2252-4173-B37A-B8CA0218CE0C"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00EB368F-5471-42E3-BBBE-EF9E623A7259"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F65406CF-59F1-48DC-8ABC-501F210A8B73"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03AC5144-140D-48E9-87FD-96F2E248D4E4"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8F12660-10A7-4B66-94B0-954C9CD7D36C"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.6c:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9D9A19A-7A43-4E67-A5A7-7DF60926EB95"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.6d:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1DFBF5F9-AA51-45A7-BE6E-0A06778773B3"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFBE40D8-27C0-4E06-993E-AA07DCD5B4C0"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.7a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69F58020-7D60-4376-BF2B-602A24C3F4EE"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3BF566D7-4537-49F6-91BF-F56D64DAE6DC"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.8a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18657E92-FA64-43CD-98CD-6C9AFAF3C3BE"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E3F1F44C-B65B-49C4-B6E8-30560D5B7663"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0_beta1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1BACCC9-0871-4BAE-B8E1-783EF6A2DC99"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0_rc1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "639E102D-2BD2-42FF-999A-02135A3E5647"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0_rc2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA7F5CF1-4610-47D0-A6DD-DCB55645245D"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0_rc3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB898F63-F327-44B1-B6A2-889E490E583F"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0_rc4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "894A26BD-2D8B-4DE7-BEE3-940A0498DB74"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}