CVE-2015-5285
CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the came_from parameter to _admin/login.
- EPSS
- 6.1% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- kallithea-scm:kallithea
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vfg9-phjp-9frw | PyPI | kallithea | <0.3 | 0.3 |
| PYSEC-2015-13 | PyPI | kallithea | <0.3 | 0.3 |
References
- http://packetstormsecurity.com/files/133897/Kallithea-0.2.9-HTTP-Response-Splitting.html
- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5267.php
- https://kallithea-scm.org/security/cve-2015-5285.html
- https://www.exploit-db.com/exploits/38424/
- http://packetstormsecurity.com/files/133897/Kallithea-0.2.9-HTTP-Response-Splitting.html