CVE-2024-5193

Katalog CVE

CVSS 5.3 · Medium EPSS 0,66%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada ritlabs tinyweb. Skor CVSS 3.1 5.3 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A security vulnerability has been detected in Ritlabs TinyWeb Server 1.94. This vulnerability affects unknown code of the component Request Handler. The manipulation with the input %0D%0A leads to crlf injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.99 is able to resolve this issue. The identifier of the patch is d49c3da6a97e950975b18626878f3ee1f082358e. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure but did not respond in any way.

Rincian

Terbit di NVD

22 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.265830 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.333059 advisory pihak ketiga · vdb entry
• https://github.com/DMCERTCE/CRLF_Tiny exploit
• https://github.com/maximmasiutin/TinyWeb/commit/d49c3da6a97e950975b18626878f3ee1f082358e
• https://github.com/maximmasiutin/TinyWeb/releases/tag/v1.99
• https://vuldb.com/?ctiid.265830 permissions required · vdb entry
• https://www.masiutin.net/tinyweb-cve-2024-5193.html