CVE-2007-4190

Summary

CRLF injection vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to inject arbitrary HTTP headers and probably conduct HTTP response splitting attacks via CRLF sequences in the url parameter. NOTE: this can be leveraged for cross-site scripting (XSS) attacks. NOTE: some of these details are obtained from third party information.

Impact & exploitability

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products we track (1)

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Official patch: http://secunia.com/advisories/26239 ↗

Additional information

• NVD record
• http://secunia.com/advisories/26239Patch
• http://www.joomla.org/content/view/3677/1/Advisory
• http://osvdb.org/38739
• http://www.vupen.com/english/advisories/2007/2719Advisory