CVE-2010-0155

CRLF injection vulnerability in load.php in the Local Management Interface (LMI) on the IBM Proventia Network Mail Security System (PNMSS) appliance with firmware before 2.5 allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the javaVersion parameter.

CVSS v2.0 3.5 LOW

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/archive/1/513636/100/0/threaded
http://www.ventuneac.net/security-advisories/MVSA-10-009

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:ibm:proventia_network_mail_security_system_virtual_appliance:*:*:*:*:*:*:*:*

cpe:2.3:a:ibm:proventia_network_mail_security_system_virtual_appliance_firmware:1.6:*:*:*:*:*:*:*

History

No history.

Information

Published : 2010-09-14 17:00

Updated : 2024-02-04 17:54

NVD link : CVE-2010-0155

Mitre link : CVE-2010-0155

CVE.ORG link : CVE-2010-0155

JSON object : View

Products Affected

ibm

proventia_network_mail_security_system_virtual_appliance
proventia_network_mail_security_system_virtual_appliance_firmware

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2010-0155", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2010-09-14T17:00:01.480", "references": [{"url": "http://www.securityfocus.com/archive/1/513636/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.ventuneac.net/security-advisories/MVSA-10-009", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "CRLF injection vulnerability in load.php in the Local Management Interface (LMI) on the IBM Proventia Network Mail Security System (PNMSS) appliance with firmware before 2.5 allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the javaVersion parameter."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n CRLF (se refiere a CR (retorno de carro) y LF (salto de l\u00ednea)) en Local Management Interface (LMI) en el dispositivo IBM Proventia Network Mail Security System (PNMSS) con firmware anterior a la versi\u00f3n 2.5 permite a atacantes remotos autenticados inyectar cabeceras HTTP de su elecci\u00f3n y llevar a cabo ataques de separaci\u00f3n de respuesta HTTP a trav\u00e9s del par\u00e1metro \"javaVersion\"."}], "lastModified": "2018-10-10T19:51:12.930", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:proventia_network_mail_security_system_virtual_appliance:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4AE7B81-387C-446B-B5EF-B897C39D15A1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:proventia_network_mail_security_system_virtual_appliance_firmware:1.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3A62936-C40C-40DF-8222-ABD6D287CAC5"}], "operator": "OR"}], "operator": "AND"}], "evaluatorImpact": "Per: http://www.ventuneac.net/security-advisories/MVSA-10-009\r\n\r\nAffected Versions\r\n\r\nIBM Proventia Network Mail Security System - virtual appliance (firmware 1.6)", "sourceIdentifier": "cve@mitre.org"}