CVE-2011-1895
Summary
| CVE | CVE-2011-1895 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2011-10-12 02:52:00 UTC |
| Updated | 2018-10-12 22:01:00 UTC |
| Description | CRLF injection vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks and cross-site scripting (XSS) attacks, via unspecified vectors, aka "ExcelTable Response Splitting XSS Vulnerability." |
Risk And Classification
Problem Types: CWE-94
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Microsoft | Forefront Unified Access Gateway | 2010 | All | All | All |
| Application | Microsoft | Forefront Unified Access Gateway | 2010 | sp1 | All | All |
| Application | Microsoft | Forefront Unified Access Gateway | 2010 | update1 | All | All |
| Application | Microsoft | Forefront Unified Access Gateway | 2010 | update2 | All | All |
| Application | Microsoft | Forefront Unified Access Gateway | 2010 | All | All | All |
| Application | Microsoft | Forefront Unified Access Gateway | 2010 | sp1 | All | All |
| Application | Microsoft | Forefront Unified Access Gateway | 2010 | update1 | All | All |
| Application | Microsoft | Forefront Unified Access Gateway | 2010 | update2 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Repository / Oval Repository | OVAL | oval.cisecurity.org | |
| 76235 | OSVDB | osvdb.org | |
| Microsoft Security Bulletin MS11-079 - Important | Microsoft Docs | MS | docs.microsoft.com | |
| Microsoft Forefront Unified Access Gateway (CVE-2011-1895) HTTP Response Splitting Vulnerability | BID | www.securityfocus.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.