VulnerabilityModified

CVE-2011-5279

CRLF injection vulnerability in the CGI implementation in Microsoft Internet Information Services (IIS) 4.x and 5.x on Windows NT and Windows 2000 allows remote attackers to modify arbitrary uppercase environment variables via a \n (newline) character…

MEDIUM 5.0EPSS 19.2%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 19.2%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.

Description

CVSS 2.0: 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS: 19.24% probability · 97th percentile
CISA KEV: Not listed
Affected: microsoft/internet information services
Source: cve@mitre.org

References

http://hi.baidu.com/yuange1975/item/b2cc7141c22108e91e19bc2eThird Party Advisory
http://seclists.org/fulldisclosure/2012/Apr/0Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2012/Apr/13Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2014/Apr/108Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2014/Apr/128Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2014/Apr/247Exploit, Mailing List, Third Party Advisory
http://hi.baidu.com/yuange1975/item/b2cc7141c22108e91e19bc2eThird Party Advisory
http://seclists.org/fulldisclosure/2012/Apr/0Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2012/Apr/13Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2014/Apr/108Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2014/Apr/128Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2014/Apr/247Exploit, Mailing List, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.