CVE-2005-2089

Publicada em 30 jun 2005 · Atualizada em 07 ago 2024

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

15Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 31%

Microsoft IIS 5.0 and 6.0 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes IIS to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."

Produtos afetados

n/a · n/a

Referências

http://seclists.org/lists/bugtraq/2005/Jun/0025.html https://exchange.xforce.ibmcloud.com/vulnerabilities/42899 http://www.securiteam.com/securityreviews/5GP0220G0U.html http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf