CVE-2007-2292

CVSS V2 Medium 4.3 CVSS V3 None
Description
CRLF injection vulnerability in the Digest Authentication support for Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allows remote attackers to conduct HTTP request splitting attacks via LF (%0a) bytes in the username attribute.
Overview
  • CVE ID
  • CVE-2007-2292
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2007-04-26T20:19:00
  • Last Modified Date
  • 2021-07-23T15:05:45
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:microsoft:internet_explorer:7.0.5730.11:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* 1 OR 2.0.0.8
cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:* 1 OR 1.1.5
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:N/I:P/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • NONE
  • Base Score
  • 4.3
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8.6
  • Impact Score
  • 2.9
References
Reference URL Reference Tags
http://www.wisec.it/vulns.php?id=11
http://www.securityfocus.com/bid/23668
http://www.securitytracker.com/id?1017968
https://bugzilla.mozilla.org/show_bug.cgi?id=378787
http://www.mozilla.org/security/announce/2007/mfsa2007-31.html
https://issues.rpath.com/browse/RPL-1858
http://support.novell.com/techcenter/psdb/60eb95b75c76f9fbfcc9a89f99cd8f79.html
http://www.debian.org/security/2007/dsa-1396
http://www.debian.org/security/2007/dsa-1401
http://www.debian.org/security/2007/dsa-1392
https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00285.html
https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00355.html
http://www.gentoo.org/security/en/glsa/glsa-200711-14.xml
http://www.mandriva.com/en/security/advisories?name=MDKSA-2007:202
http://www.redhat.com/support/errata/RHSA-2007-0979.html
http://www.redhat.com/support/errata/RHSA-2007-0980.html
http://www.redhat.com/support/errata/RHSA-2007-0981.html
http://www.novell.com/linux/security/advisories/2007_57_mozilla.html
http://www.ubuntu.com/usn/usn-536-1
http://secunia.com/advisories/27276 Vendor Advisory
http://secunia.com/advisories/27325 Vendor Advisory
http://secunia.com/advisories/27327 Vendor Advisory
http://secunia.com/advisories/27335 Vendor Advisory
http://secunia.com/advisories/27356 Vendor Advisory
http://secunia.com/advisories/27383 Vendor Advisory
http://secunia.com/advisories/27425 Vendor Advisory
http://secunia.com/advisories/27403 Vendor Advisory
http://secunia.com/advisories/27480 Vendor Advisory
http://secunia.com/advisories/27387 Vendor Advisory
http://secunia.com/advisories/27298 Vendor Advisory
http://secunia.com/advisories/27311 Vendor Advisory
http://secunia.com/advisories/27315 Vendor Advisory
http://secunia.com/advisories/27336 Vendor Advisory
http://secunia.com/advisories/27665 Vendor Advisory
http://secunia.com/advisories/27414 Vendor Advisory
http://securityreason.com/securityalert/2654
https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00498.html
http://secunia.com/advisories/27680
http://secunia.com/advisories/27360
http://secunia.com/advisories/28398
http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://www.vupen.com/english/advisories/2007/3544
http://www.vupen.com/english/advisories/2007/3587
http://www.vupen.com/english/advisories/2008/0083
https://exchange.xforce.ibmcloud.com/vulnerabilities/33981
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10195
https://usn.ubuntu.com/535-1/
http://www.securityfocus.com/archive/1/482932/100/200/threaded
http://www.securityfocus.com/archive/1/482925/100/0/threaded
http://www.securityfocus.com/archive/1/482876/100/200/threaded
http://www.securityfocus.com/archive/1/466906/100/0/threaded
History
Created Old Value New Value Data Type Notes
2022-05-10 15:53:26 Added to TrackCVE