Description

Drupal Core is prone to a HTTP response splitting vulnerability because it fails to properly verify user-supplied input. An attacker may leverage this issue to influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust. Drupal Core versions 5.x ranging from 5.0 and up to and including 5.2 are vulnerable.

Remediation

Update to Drupal Core version 5.3 or latest

References

https://www.drupal.org/node/184315

Related Vulnerabilities

PHP Improper Input Validation Vulnerability (CVE-2014-5120)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-40604)

WordPress Plugin Paytium:Mollie payment forms & donations Cross-Site Scripting (3.1.1)

WordPress Plugin Amazon Product in a Post SQL Injection (3.5.2)

WordPress Plugin Ultimate Appointment Booking & Scheduling Unspecified Vulnerability (1.1.10)

Severity

High

Classification

CVE-2007-5595 CWE-113 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Http Response Splitting