CRLF Injection Vulnerability in Weaver e-cology by Weaver Technologies
CVE-2019-10272

6.1MEDIUM

Key Information:

Vendor

Weaver

Status
E-cology
Vendor
CVE Published:
30 April 2019

What is CVE-2019-10272?

A CRLF injection vulnerability exists in Weaver e-cology 9.0, allowing attackers to manipulate HTTP response headers via the 'isintervenor' parameter in the 'ViewRequestForwardSPA.jsp' page. By exploiting this vulnerability, an attacker could inject arbitrary HTTP headers, leading to the potential hijacking of user sessions or malicious redirections. Proper input validation and sanitization measures are essential to mitigate this risk.

References

https://www.weaver.com.cn/cs/securityDownload.asp
x_refsource_CONFIRM
https://expzh.com/Weaver-e-cology9.0-CRLF-Injection.pdf
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.