CVE-2016-1900: XSS
CRLF injection vulnerability in the cgitprinthttpheaders function in ui-shared.c in CGit before 0.12 allows remote attackers with permission to write to a repository to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via newline characters in a filename.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1900?
CVE-2016-1900 has a medium severity rating due to the potential for HTTP response splitting and XSS attacks.
How do I fix CVE-2016-1900?
To fix CVE-2016-1900, upgrade to CGit version 0.12 or later.
Who is affected by CVE-2016-1900?
CVE-2016-1900 affects users of CGit versions up to 0.11.2 and Fedora 22.
What types of attacks can exploit CVE-2016-1900?
CVE-2016-1900 can be exploited for HTTP response splitting attacks and cross-site scripting (XSS) attacks.
What are the implications of CVE-2016-1900?
The implications of CVE-2016-1900 include the potential for unauthorized data manipulation and unauthorized access to sensitive user information through crafted HTTP responses.