SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2008-0456

CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject…

LOW 2.6EPSS 19.0%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 19.0%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.

Description

CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.

CVSS 2.0
2.6 LOWAV:N/AC:H/Au:N/C:N/I:P/A:N
EPSS
19.04% probability · 97th percentile
CISA KEV
Not listed
Weakness
CWE-74
Affected
apache/http server · redhat/enterprise linux desktop · redhat/enterprise linux server · redhat/enterprise linux workstation
Source
cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.