CVE-2013-2950 — Code Injection in IBM Websphere Portal

CWE-94 — Code Injection3 documents3 sources
Severity
3.5LOWNVD
EPSS
0.2%
top 59.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Websphere Portal
Timeline
PublishedJun 3
Latest updateMay 17

Description

CRLF injection vulnerability in IBM WebSphere Portal 6.1.0.x before 6.1.0.3 CF26, 6.1.5.x before 6.1.5 CF26, 7.0.0.x before 7.0.0.2 CF21, and 8.0.0.x through 8.0.0.1 CF5, when home substitution (aka uri.home.substitution) is enabled, allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 6.8 | Impact: 2.9

Affected Packages1 packages

▶NVDibm/websphere_portal11 versions+10

🔴Vulnerability Details

2
GHSA
GHSA-7jfq-mvq9-hxph: CRLF injection vulnerability in IBM WebSphere Portal 6↗2022-05-17
▶
CVEList
CVE-2013-2950: CRLF injection vulnerability in IBM WebSphere Portal 6↗2013-06-03
▶
CVE-2013-2950 — Code Injection in IBM Websphere Portal | cvebase