SnipSnap: HTTP response splitting
Gentoo Linux Security Advisory
||GLSA 200409-23 / snipsnap
||September 17, 2004
||May 22, 2006: 02
All supported architectures
SnipSnap is vulnerable to HTTP response splitting attacks such as web cache
poisoning, cross-user defacement, and cross-site scripting.
SnipSnap is a user friendly content management system with features
such as wiki and weblog.
SnipSnap contains various HTTP response splitting vulnerabilities that
could potentially compromise the sites data. Some of these attacks
include web cache poisoning, cross-user defacement, hijacking pages
with sensitive user information, and cross-site scripting. This
vulnerability is due to the lack of illegal input checking in the
A malicious user could inject and execute arbitrary script code,
potentially compromising the victim's data or browser.
There is no known workaround at this time.
All SnipSnap users should upgrade to the latest version:
Code Listing 3.1: Resolution
# emerge sync
# emerge -pv ">=dev-java/snipsnap-bin-1.0_beta1"
# emerge ">=dev-java/snipsnap-bin-1.0beta1"