CVE-2011-1718 The Web Agents component in CA SiteMinder R6 before SP6 CR2 and R12 before SP3 CR2 does not properly handle multi-line headers, which allows remote authenticated users to conduct impersonation attacks...
MediumCVSS 4.3
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Web Agents component in CA SiteMinder R6 before SP6 CR2 and R12 before SP3 CR2 does not properly handle multi-line headers, which allows remote authenticated users to conduct impersonation attacks and gain privileges via crafted data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| broadcom siteminder | = 12.0-sp3 | No fix listed |
| ca siteminder | = 6-sp5_cr35 | No fix listed |
References
- 44218 third-party-advisory vendor-advisory
- 8227 third-party-advisory
- 1025423 vdb-entry
- 20110421 CA20110420-01: Security Notice for CA SiteMinder mailing-list
- 47520 vdb-entry
- ADV-2011-1067 vdb-entry vendor-advisory
- siteminder-headers-spoofing(66906) vdb-entry
- support.ca.com