CVE-2012-5486: XSS
A HTTP header injection flaw was found in the way Plone, a user friendly and powerful content management system, performed sanitization of HTTP headers provided within certain URL requests. A remote attacker could provide a specially-crafted URL that, when processed would lead the injected HTTP headers to be returned as part of Plone system HTTP response (possibly leading to HTTP response splitting, cross-site scripting [XSS] flaws, session fixation or unauthorized HTTP redirect attacks - to mention some of the possible negative consequences).
References: [1] http://plone.org/products/plone/security/advisories/20121106/02 [2] http://plone.org/products/plone/security/advisories/20121106/
Relevant upstream HotFixes: [3] http://plone.org/products/plone-hotfix/releases/20121106
From the OSS post: [4] http://www.openwall.com/lists/oss-security/2012/11/07/4
the setHeader.py change from upstream HotFix is relevant to this issue.
Other sources
ZPublisher.HTTPRequest.scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5486?
CVE-2012-5486 has a severity rating of medium due to the potential for HTTP header injection, which could allow attackers to manipulate responses.
How do I fix CVE-2012-5486?
To mitigate CVE-2012-5486, upgrade to the latest versions of Plone or Zope that have addressed this vulnerability.
Who is affected by CVE-2012-5486?
CVE-2012-5486 affects various versions of the Plone content management system and certain Zope versions.
What types of attacks can exploit CVE-2012-5486?
Attackers can exploit CVE-2012-5486 through crafted URLs that inject malicious HTTP headers.
Is there a workaround for CVE-2012-5486?
While upgrading is the best solution, you could potentially restrict access to vulnerable endpoints to mitigate risks while achieving a full upgrade.