CVE-2018-11347 Other in n/a
Attackers can inject HTTP headers via malicious links, enabling redirection or cache poisoning in YunoHost web applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-11347?
CVE-2018-11347 is a high-severity vulnerability in n/a, published on 4 Dec 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The YunoHost 2.7.2 through 2.7.14 web application is affected by one HTTP Response Header Injection. This flaw allows an attacker to inject, into the response from the server, one or several HTTP Header. It requires an interaction with the user to send him the malicious link. It could be used to perform other attacks such as user redirection to a malicious website, HTTP response splitting, or HTTP cache poisoning.
Weakness: CWE-113
Which versions are affected by CVE-2018-11347?
It affects 1 product.
Products include Yunohost Yunohost.
How do I fix CVE-2018-11347?
No fix has been published for CVE-2018-11347 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-11347 being exploited?
There is no known exploitation of CVE-2018-11347 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-g2pg-xwqc-r429.