VulnerabilityModified
CVE-2002-1405
CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on the command line, via a URL containing encoded carriage return, line feed, and other whitespace…
MEDIUM 5.0EPSS 5.04%
Does this matter?
Lower severity and a low EPSS score (5.04%). Track it; it rarely justifies an emergency change on its own.
Description
CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on the command line, via a URL containing encoded carriage return, line feed, and other whitespace characters.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
- EPSS
- 5.04% probability · 92th percentile
- CISA KEV
- Not listed
- Affected
- elinks/elinks · links/links · university of kansas/lynx
- Source
- cve@mitre.org
References
- ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-049.0.txt
- http://marc.info/?l=bugtraq&m=102978118411977&w=2
- http://marc.info/?l=bugtraq&m=103003793418021&w=2
- http://www.debian.org/security/2002/dsa-210Patch, Vendor Advisory
- http://www.iss.net/security_center/static/9887.phpPatch, Vendor Advisory
- http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:023
- http://www.redhat.com/support/errata/RHSA-2003-029.html
- http://www.redhat.com/support/errata/RHSA-2003-030.html
- http://www.securityfocus.com/bid/5499
- http://www.trustix.net/errata/misc/2002/TSL-2002-0085-lynx-ssl.asc.txt
- ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-049.0.txt
- http://marc.info/?l=bugtraq&m=102978118411977&w=2
- http://marc.info/?l=bugtraq&m=103003793418021&w=2
- http://www.debian.org/security/2002/dsa-210Patch, Vendor Advisory
- http://www.iss.net/security_center/static/9887.phpPatch, Vendor Advisory
- http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:023
- http://www.redhat.com/support/errata/RHSA-2003-029.html
- http://www.redhat.com/support/errata/RHSA-2003-030.html
- http://www.securityfocus.com/bid/5499
- http://www.trustix.net/errata/misc/2002/TSL-2002-0085-lynx-ssl.asc.txt
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.