Non notée
CVE-2021-33580 User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to…
Description
User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the regex pattern he may cause a ReDoS by regex catastrophic backtracking on the server side. This problem has been fixed in Roller 6.0.2.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Roller 6.0 | premières → < 6.0.2 | 6.0.2 |
Références
- lists.apache.org lists.apache.org
- [oss-security] 20210817 CVE-2021-33580: Apache Roller: regex injection leading to DoS www.openwall.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Roller
Les 24 CVE de Apache Roller →
CVE-2026-86507
Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted…
6.1
Moyenne
CVE-2026-82379
Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest…
7.7
Élevée
CVE-2026-82380
Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform…
8.1
Élevée
CVE-2026-82381
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a…
5.4
Moyenne