CVE-2023-26137
Assigner: snyk
Published: 2023-07-06T05:00:03.695Z
State: PUBLISHED
metrics: cvssV3_1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 7.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:P
credits: value: Alessio Della Libera - Snyk Research Team
problemTypes: descriptions: cweId: CWE-113
description: HTTP Response Splitting
descriptions: value: All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and addCookie functions. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content.
affected: product: drogonframework/drogon
versions: version: 0
lessThan: *
status: affected
versionType: semver
vendor: n/a