VulnerabilityModified

CVE-2008-3906

CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string.

MEDIUM 4.3EPSS 7.10%

Does this matter?

Lower severity and a low EPSS score (7.10%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS: 7.10% probability · 94th percentile
CISA KEV: Not listed
Weakness: CWE-20
Affected: mono/mono · mono project/mono
Source: cve@mitre.org

References

http://secunia.com/advisories/31643Vendor Advisory
http://secunia.com/advisories/36494
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0286
http://www.mandriva.com/security/advisories?name=MDVSA-2008:210
http://www.openwall.com/lists/oss-security/2008/08/27/6
http://www.securityfocus.com/archive/1/496845/100/0/threaded
http://www.securityfocus.com/bid/30867Exploit
http://www.vupen.com/english/advisories/2008/2443
https://bugzilla.novell.com/show_bug.cgi?id=418620
https://exchange.xforce.ibmcloud.com/vulnerabilities/44740
https://usn.ubuntu.com/826-1/
http://secunia.com/advisories/31643Vendor Advisory
http://secunia.com/advisories/36494
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0286
http://www.mandriva.com/security/advisories?name=MDVSA-2008:210
http://www.openwall.com/lists/oss-security/2008/08/27/6
http://www.securityfocus.com/archive/1/496845/100/0/threaded
http://www.securityfocus.com/bid/30867Exploit
http://www.vupen.com/english/advisories/2008/2443
https://bugzilla.novell.com/show_bug.cgi?id=418620
https://exchange.xforce.ibmcloud.com/vulnerabilities/44740
https://usn.ubuntu.com/826-1/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.