CVE-2019-10272: CRLF Injection

Published Apr 30, 2019

Updated

An issue was discovered in Weaver e-cology 9.0. There is a CRLF Injection vulnerability via the /workflow/request/ViewRequestForwardSPA.jsp isintervenor parameter, as demonstrated by the %0aSet-cookie: substring.

Affected Software

1 affected component

weaver e-cology=9.0

Event History

Apr 30, 2019

CVE Published

via MITRE·05:47 PM

Data Sourced

via MITRE·05:47 PM

Description

Frequently Asked Questions

What is the severity of CVE-2019-10272?

CVE-2019-10272 has been classified as a medium severity vulnerability due to its potential for user impersonation and server response manipulation.

How do I fix CVE-2019-10272?

To mitigate CVE-2019-10272, it's essential to sanitize input in the isintervenor parameter to prevent CRLF injection.

What software versions are affected by CVE-2019-10272?

CVE-2019-10272 specifically affects Weaver e-cology version 9.0.

What kind of attack is possible with CVE-2019-10272?

CVE-2019-10272 can be exploited to perform CRLF injection attacks, allowing attackers to manipulate HTTP responses.

Is CVE-2019-10272 easy to exploit?

Yes, CVE-2019-10272 is relatively easy to exploit, especially if input validation is not adequately implemented.