CVE-2004-2512 Other in n/a
Remote attackers can perform HTTP response splitting via CRLF injection in the PHPSESSID parameter, enabling web cache poisoning and content spoofing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2004-2512?
CVE-2004-2512 is a medium-severity vulnerability in n/a, published on 25 Oct 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CRLF injection vulnerability in calendar.php in DCP-Portal 5.3.2 and earlier allows remote attackers to conduct HTTP response splitting attacks to spoof web content and poison web caches via CRLF ("%0d%0a") sequences in the PHPSESSID parameter.
Which versions are affected by CVE-2004-2512?
It affects 1 product.
Products include Codeworx Technologies Dcp-Portal.
How do I fix CVE-2004-2512?
No fix has been published for CVE-2004-2512 yet. Limit exposure of the affected software until one is available.
Is CVE-2004-2512 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2004-2512 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-pjgq-j3j9-v9h8.