CVE-2015-5285

CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the came_from parameter to _admin/login.

CVSS v4.0

8.9 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

6.09% chance of exploitation in the next 30 days, 93th percentile

Published

2015-10-29

Updated

2024-08-06

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/38424

References

• CVE Record
• NVD entry

Related

• CVE-2015-5273
• CVE-2015-5287
• CVE-2015-5254
• CVE-2015-5308
• CVE-2015-5243
• CVE-2015-5317