CVE-2023-26138

Katalog CVE

CVSS 4.3 · Medium EPSS 0,42%

Kerentanan Improper Neutralization of CRLF Sequences ('CRLF Injection') pada drogon. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

All versions of the package drogonframework/drogon are vulnerable to CRLF Injection when untrusted user input is used to set request headers in the addHeader function. An attacker can add the \r\n (carriage return line feeds) characters and inject additional headers in the request sent.

Rincian

Terbit di NVD

6 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.snyk.io/vuln/SNYK-UNMANAGED-DROGONFRAMEWORKDROGON-5665555 advisory pihak ketiga
• https://gist.github.com/dellalibera/d2abd809f32ec6c61be1f41d80edf61b exploit