Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: Drogon Clear all filters
TI-2023-11361 CVE-2023-26137 · GHSA-73h3-w2hp-q47q

HTTP response splitting in drogonframework/drogon

Priority HIGH 71

All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and addCookie functions.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00434 Published 2023-07-06 No fix listed CWE-113
TI-2023-11362 CVE-2023-26138 · GHSA-3jvv-m32r-4hpf

Injection in drogonframework/drogon

Priority MEDIUM 58

All versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to set request headers in the addHeader function.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00424 Published 2023-07-06 No fix listed CWE-93
TI-2022-03628 CVE-2022-3959 · GHSA-jx25-8rr2-353v

drogon Session Hash small space of random values

Priority LOW 26

A vulnerability, which was classified as problematic, has been found in drogon up to 1.8.1.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01129 Published 2022-11-11 No fix listed CWE-330
TI-2022-08991 CVE-2022-25297 · GHSA-5gj5-vjr8-vv8h

Arbitrary file write in drogonframework/drogon

Priority MEDIUM 41

This affects the package drogonframework/drogon before 1.7.5.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01647 Published 2022-02-21 Fixed in 1.7.5 CWE-552