CVE-2020-5249

puma

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2020-5249

Katalog CVE

CVSS 6.5 · Medium EPSS 1,6%

Kerentanan Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') pada puma. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to CVE-2020-5247, which fixed this vulnerability but only for regular responses. This has been fixed in 4.3.3 and 3.12.4.

Rincian

Terbit di NVD
2 Maret 2020
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
EPSS (30 hari)
1,6% peluang dieksploitasi; lebih tinggi dari 74,7% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
puma puma Semua versi hingga 3.12.3
puma puma Versi 4.0.0 hingga 4.3.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.