Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the came_from parameter to _admin/login.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Kallithea CRLF注入漏洞
Vulnerability Description
Kallithea是美国Software Freedom Conservancy组织下的一个项目，是一套免费的源码管理系统。该系统支持Mercurial和Git版本控制系统、托管代码、管理访问控制等。 Kallithea 0.3之前版本中存在CRLF注入漏洞，该漏洞源于_admin/login URI没有充分过滤‘came_from’参数。远程攻击者可利用该漏洞注入任意HTTP头，实施HTTP响应拆分攻击。
CVSS Information
N/A
Vulnerability Type
N/A