NVD

Id
18484  
Name
CVE-2016-2216  
Description
The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2016-04-07  
Modified Date
2016-04-11  
Seq
2016-2216  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
102795 18484 CVE-2016-2216 http://blog.safebreach.com/2016/02/09/http-response-splitting-in-node-js-root-cause-analysis/  View
102796 18484 CVE-2016-2216 http://info.safebreach.com/hubfs/Node-js-Response-Splitting.pdf  View
102797 18484 CVE-2016-2216 FEDORA-2016-3102c11757  View
102798 18484 CVE-2016-2216 FEDORA-2016-8925b6119f  View
102799 18484 CVE-2016-2216 http://packetstormsecurity.com/files/135711/Node.js-HTTP-Response-Splitting.html  View
102800 18484 CVE-2016-2216 83141  View
102801 18484 CVE-2016-2216 https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
1223 JVNDB-2016-001996 Node.js の HTTP ヘッダ構文解析コードにおける HTTP レスポンス分割保護メカニズムを回避される脆弱性 Node.js の HTTP ヘッダ構文解析コードには、HTTP レスポンス分割保護メカニズムを回避される脆弱性が存在します。 CVE-2016-2216 88722 CVE-2016-2216 18484 4.3 7.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-001996.html 2016-02-09 2016-04-12 View