CVE-2016-1899: XSS
CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via CRLF sequences in the mimetype parameter, as demonstrated by a request to blob/cgit.c.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1899?
CVE-2016-1899 is classified as a high severity vulnerability due to the potential for remote attackers to execute cross-site scripting and HTTP response splitting attacks.
How do I fix CVE-2016-1899?
To fix CVE-2016-1899, upgrade CGit to version 0.12 or later, or apply any relevant security patches provided by your distribution.
Which versions of CGit are affected by CVE-2016-1899?
CVE-2016-1899 affects CGit versions up to and including 0.11.2.
Does CVE-2016-1899 affect Fedora 22?
Yes, CVE-2016-1899 affects Fedora 22 as it includes the vulnerable versions of CGit.
What kind of attacks can be executed due to CVE-2016-1899?
CVE-2016-1899 allows for HTTP response splitting and cross-site scripting attacks due to CRLF injection.