Executive brief
CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the came_from parameter to _admin/login.
Affected products
- PyPI kallithea
Junglewise Threat Intelligence
CVE-2015-5285: PYSEC-2015-13 - CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response spli
CVE-2015-5285 · Severity: low · CVSS 3.1 · Published 2015-10-29
Technologies: kallithea (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-648 - Kallithea Routes CSRF Bypass
- PYSEC-2017-16 - Cross-site request forgery (CSRF) vulnerability in Kallithea before 0.2.
- PYSEC-2017-17 - Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject a
- PYSEC-2015-32 - RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_re