Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Bref Multiple Value Headers Not Supported in ApiGatewayFormatV2
Vulnerability Description
Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple `Content-Security-Policy` headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Vulnerability Type
解释冲突
Vulnerability Title
Bref 安全漏洞
Vulnerability Description
Bref是Matthieu Napoli个人开发者的一个开源项目，可帮助您使用 PHP 在 AWS 上实现无服务器。 Bref 2.1.13之前版本存在安全漏洞，该漏洞源于当 Bref 与 v2 格式的 API 网关结合使用时，不处理多个值标头。
CVSS Information
N/A
Vulnerability Type
N/A