« Volver al listado

CVE-2010-0155

Estado: ModificadaBaja (3.5)—

CRLF injection vulnerability in load.php in the Local Management Interface (LMI) on the IBM Proventia Network Mail Security System (PNMSS) appliance with firmware before 2.5 allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the javaVersion parameter.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

IBM — Proventia Network Mail Security System Virtual ApplianceIBM — Proventia Network Mail Security System Virtual Appliance Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-0155",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-09-14T17:00:01.480",
  "references": [
    {
      "url": "http://www.securityfocus.com/archive/1/513636/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.ventuneac.net/security-advisories/MVSA-10-009",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/513636/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ventuneac.net/security-advisories/MVSA-10-009",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CRLF injection vulnerability in load.php in the Local Management Interface (LMI) on the IBM Proventia Network Mail Security System (PNMSS) appliance with firmware before 2.5 allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the javaVersion parameter."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección CRLF (se refiere a CR (retorno de carro) y LF (salto de línea)) en Local Management Interface (LMI) en el dispositivo IBM Proventia Network Mail Security System (PNMSS) con firmware anterior a la versión 2.5 permite a atacantes remotos autenticados inyectar cabeceras HTTP de su elección y llevar a cabo ataques de separación de respuesta HTTP a través del parámetro \"javaVersion\"."
    }
  ],
  "lastModified": "2026-06-16T23:15:34.960",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:proventia_network_mail_security_system_virtual_appliance:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4AE7B81-387C-446B-B5EF-B897C39D15A1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:proventia_network_mail_security_system_virtual_appliance_firmware:1.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3A62936-C40C-40DF-8222-ABD6D287CAC5"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "evaluatorImpact": "Per: http://www.ventuneac.net/security-advisories/MVSA-10-009\r\n\r\nAffected Versions\r\n\r\nIBM Proventia Network Mail Security System - virtual appliance (firmware 1.6)",
  "sourceIdentifier": "cve@mitre.org"
}