Description
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.
Remediation
References
Related Vulnerabilities
WordPress Plugin Nextend Google Connect Cross-Site Scripting (1.5.0)
WordPress Plugin Advanced Access Manager Unspecified Vulnerability (5.9.8.1)
Drupal Core 6.x Multiple Vulnerabilities (6.0 - 6.34)
concrete5 Server-Side Request Forgery (SSRF) Vulnerability (CVE-2018-13790)
WordPress Plugin Secure HTML5 Video Player Cross-Site Scripting (3.3)