CVE-2007-2618
CRLF injection vulnerability in index.php in Drake CMS 0.4.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the lang parameter.
Does this matter?
Lower severity and a low EPSS score (1.19%). Track it; it rarely justifies an emergency change on its own.
Description
CRLF injection vulnerability in index.php in Drake CMS 0.4.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the lang parameter. NOTE: Drake CMS has only a beta version available, and the vendor has previously stated "We do not consider security reports valid until the first official release of Drake CMS."
- CVSS 2.0
- 5.1 MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
- EPSS
- 1.19% probability · 66th percentile
- CISA KEV
- Not listed
- Affected
- drake team/drake cms
- Source
- cve@mitre.org
References
- http://osvdb.org/37303
- http://securityreason.com/securityalert/2691
- http://www.securityfocus.com/archive/1/467829/100/0/threaded
- http://www.securityfocus.com/bid/23851
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34145
- http://osvdb.org/37303
- http://securityreason.com/securityalert/2691
- http://www.securityfocus.com/archive/1/467829/100/0/threaded
- http://www.securityfocus.com/bid/23851
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34145
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.