CVE-2005-2094: XSS
Sun SunONE web server 6.1 SP1 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes SunONE to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2005-2094?
CVE-2005-2094 is considered a moderate severity vulnerability due to its potential to allow remote attackers to exploit the web server.
How do I fix CVE-2005-2094?
To fix CVE-2005-2094, you should update Sun ONE Web Server to a version that addresses this vulnerability.
What types of attacks can be performed using CVE-2005-2094?
CVE-2005-2094 can be exploited to poison the web cache, bypass web application firewall protections, and conduct cross-site scripting (XSS) attacks.
Which version of Sun ONE Web Server is affected by CVE-2005-2094?
CVE-2005-2094 specifically affects Sun ONE Web Server version 6.1 SP1.
What is the cause of the vulnerability CVE-2005-2094?
CVE-2005-2094 arises from the server's mishandling of HTTP requests that include both 'Transfer-Encoding: chunked' and a 'Content-Length' header.