GitHub Advisoryadvisory · Packagist

GHSA-h22q-g2c7-2jwj Joomla! vulnerable to CRLF injection

MEDIUM Published 2022-05-01 Modified 2023-09-22 Official page ↗
Aliases
CVE-2007-4190
Ecosystem
Packagist
Packages
joomla/application
Severity
Moderate
Weaknesses
CWE-93
Reviewed
2023-09-22

Affected packages

• Packagist joomla/application: < 1.0.13 → fixed in 1.0.13

Description

CRLF injection vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to inject arbitrary HTTP headers and probably conduct HTTP response splitting attacks via CRLF sequences in the url parameter. NOTE: this can be leveraged for cross-site scripting (XSS) attacks. NOTE: some of these details are obtained from third party information.

Related

Alias · CVE (1)

  • CVE-2007-4190 CRLF injection vulnerability in Joomla! vulnerability

Weakness · CWE (1)

  • CWE-93 Improper Neutralization of CRLF Sequences weakness

References