CVE-2017-745926.06.2017, 07:29ntopng before 3.0 allows HTTP Response Splitting.InjectionEnginsightProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVectorNISTNIST7.5 HIGHNETWORKLOWNONECVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NmitreCNA------CVEADP------Base ScoreCVSS 3.xEPSS ScorePercentile: 47%VendorProductVersionntopntopng𝑥≤ 2.4𝑥= Vulnerable software versionsDebian ReleasesDebian ProductCodenamentopngsid5.2.1+dfsg1-2fixedtrixie5.2.1+dfsg1-2fixedstretchno-dsajessieno-dsaUbuntu ReleasesUbuntu ProductCodenamentopngnoblenot-affectedmanticnot-affectedlunarnot-affectedkineticignoredjammyneeds-triageimpishdnehirsutenot-affectedgroovynot-affectedfocalnot-affectedeoannot-affecteddisconot-affectedcosmicnot-affectedbionicnot-affectedartfulignoredzestyignoredyakketyignoredxenialneededtrustydneCommon Weakness EnumerationCWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.Referenceshttps://github.com/ntop/ntopng/blob/3.0/CHANGELOG.mdhttps://github.com/ntop/ntopng/blob/3.0/CHANGELOG.md
