CVE-2024-1226

Katalog CVE

CVSS 7.5 · High EPSS 0,45%

Kerentanan Improper Neutralization of CRLF Sequences ('CRLF Injection'). Skor CVSS 3.1 7.5 (High) menurut incibe.es.

Deskripsi (NVD)

The software does not neutralize or incorrectly neutralizes certain characters before the data is included in outgoing HTTP headers. The inclusion of invalidated data in an HTTP header allows an attacker to specify the full HTTP response represented by the browser. An attacker could control the response and craft attacks such as cross-site scripting and cache poisoning attacks.

Rincian

Terbit di NVD

12 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

7.5 (High), sumber incibe.es
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-rejettos-http-file-server