CVE-2019-7313

MEDIUM

Buildbot 0.9.0-1.8.0 and PyPI buildbot 0.9.0-1.8.1 - CRLF Injection via Redirect Parameter

Title source: llm

Description

www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain.

References (1)

Core 1

Core References

Exploit, Patch, Third Party Advisory x_refsource_misc

https://github.com/buildbot/buildbot/wiki/CRLF-injection-in-Buildbot-login-and-logout-redirect-code

Scores

CVSS v3 6.1

EPSS 0.0087

EPSS Percentile 53.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-93

Status published

Products (2)

buildbot/buildbot 0.9.0 - 1.8.0

pypi/buildbot 0.9.0 - 1.8.1PyPI

Published Feb 03, 2019

Tracked Since Feb 18, 2026