Login Request a demo
Unscored severity · published Jul 5, 2005
CVE-2005-2094
Sun SunONE web server 6.1 SP1 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a…
–
CVSS
1.4%
EPSS
No
On KEV
Description
Sun SunONE web server 6.1 SP1 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes SunONE to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OW
One Web Server · Sun
6.1 · source: NVD
Affected product
OW
One Web Server
Sun
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-2094
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-2094
seclists.org
http://seclists.org/lists/bugtraq/2005/Jun/0025.html
securitytracker.com
http://securitytracker.com/id?1014369
www.securiteam.com
http://www.securiteam.com/securityreviews/5GP0220G0U.html
www.watchfire.com
http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/42903
More from One Web Server
–
CVE-2003-1590
Unspecified vulnerability in Sun ONE (aka iPlanet) Web Server 6.0 SP3 through SP5 on Windows allows remote attackers to cause a denial of service (daemon crash) via unknown…
–
CVE-2003-1589
Unspecified vulnerability in Sun ONE (aka iPlanet) Web Server 4.1 before SP13 and 6.0 before SP6 on Windows allows attackers to cause a denial of service (daemon crash) via…
–
CVE-2003-1579
Sun ONE (aka iPlanet) Web Server 6 on Windows, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad…
–
CVE-2003-1578
Sun ONE (aka iPlanet) Web Server 4.1 through SP12 and 6.0 through SP5, when DNS resolution is enabled for client IP addresses, allows remote attackers to hide HTTP requests from…
–
CVE-2003-1577
Sun ONE (aka iPlanet) Web Server 4.1 through SP12 and 6.0 through SP5, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text…