CVE-2005-3348

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-11-18 · updated 2026-06-16
Weakness: CWE-352

Description

HTTP response splitting vulnerability in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egroupware before 1.0.0.009, allows remote attackers to spoof web content and poison web caches via CRLF sequences in the charset parameter.

Affected products

phpsysinfo: 2.0, 2.1, 2.3, 2.4

References

http://secunia.com/advisories/17441
http://secunia.com/advisories/17570
http://secunia.com/advisories/17584
http://secunia.com/advisories/17616
http://secunia.com/advisories/17620
http://secunia.com/advisories/17643
http://secunia.com/advisories/17698
http://www.debian.org/security/2005/dsa-897
http://www.debian.org/security/2005/dsa-898
http://www.debian.org/security/2005/dsa-899
http://www.gentoo.org/security/en/glsa/glsa-200511-18.xml
http://www.hardened-php.net/advisory_212005.81.html

Get alerted when CVE-2005-3348 or the next vulnerability affects your stack