Skip to content

CVE-2012-5486

HTTP header injection in Plone and Zope2

6.4 MediumFix available

CVE-2012-5486 is a medium vulnerability (CVSS 6.4) in Plone, published September 30, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.52%, the 84th percentile. Fixed in zope2 2.13.19.

ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

Exploit likelihood

2.52%Up 1.3 points since Feb 4, 2022

What each source reports

NVD Score used 6.4

ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

Record: CVE-2012-5486
CVSS 2.0: 6.4 MediumAV:N/AC:L/Au:N/C:N/I:P/A:P
Updated: 2026-11-02

CVE List No score

ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

Record: CVE-2012-5486
Updated: 2026-11-02

EUVDEUVD-2014-0046 No score

ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

Record: EUVD-2014-0046
Updated: 2026-11-03

GitHub AdvisoriesGHSA-77hv-8796-8ccp 8.7

HTTP header injection in Plone and Zope2

ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

Record: GHSA-77hv-8796-8ccp
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVGHSA-77hv-8796-8ccp 8.7

HTTP header injection in Plone and Zope2

ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

Record: GHSA-77hv-8796-8ccp
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVPYSEC-2014-28 No score

ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

Record: PYSEC-2014-28
Updated: 2026-11-02

OSVPYSEC-2014-73 No score

ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

Record: PYSEC-2014-73
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`zope2` PyPI	before 2.13.19	2.13.19
`plone` PyPI	3.3.2 up to 4.2.3	4.2.3
`plone` PyPI	4.3a1 to 4.3a2	4.3b1
`zope2` PyPI	before 2.13.19, plus listed versions 2.12.02.12.0.a12.12.0a22.12.0a32.12.0a4 Show 45 moreShow less 2.12.0b12.12.0b22.12.0b32.12.0b42.12.0c12.12.12.12.102.12.112.12.122.12.132.12.142.12.152.12.162.12.172.12.182.12.192.12.22.12.202.12.212.12.222.12.232.12.242.12.252.12.262.12.272.12.282.12.32.12.42.12.52.12.62.12.72.12.82.12.92.13.02.13.0a12.13.0a22.13.0a32.13.0a42.13.0b12.13.0c12.13.12.13.102.13.112.13.122.13.13	2.13.19
`plone` PyPI	3.3.2 up to 4.2.3, plus listed versions 3.3.33.3.43.3.53.3.64.0 Show 44 moreShow less 4.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a24.1a34.1b14.1b24.1rc24.1rc34.24.2.14.2.24.2a14.2a24.2b14.2b24.2rc14.2rc2	4.2.3
`plone` PyPI	4.3a1 up to 4.3b1, plus listed versions 4.3a2	4.3b1
`plone` PyPI	before 4.2.3, plus listed versions 3.23.2.13.2.23.2.33.2a1 Show 45 moreShow less 3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a2	4.2.3
`conga` Red Hat:rhel_cluster:5	before 0:0.12.2-81.el5	0:0.12.2-81.el5
`conga-debuginfo` Red Hat:rhel_cluster:5	before 0:0.12.2-81.el5	0:0.12.2-81.el5
`luci` Red Hat:rhel_cluster:5	before 0:0.12.2-81.el5	0:0.12.2-81.el5
`ricci` Red Hat:rhel_cluster:5	before 0:0.12.2-81.el5	0:0.12.2-81.el5

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 46 moreShow less

This page doesn't list everything

Left out here: 27 versions. The JSON record has them.