Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2008-0456
HistoryJan 25, 2008 - 1:00 a.m.

CVE-2008-0456

2008-01-2501:00:00
CWE-74
[email protected]
web.nvd.nist.gov
198
cve-2008-0456
apache http server
mod_negotiation
crlf injection
vulnerability
http response splitting
nvd

6.2 Medium

AI Score

Confidence

Low

2.6 Low

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

0.007 Low

EPSS

Percentile

79.8%

JSON

CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) “406 Not Acceptable” or (2) “300 Multiple Choices” HTTP response when the extension is omitted in a request for the file.

References

Related

f5 2
ubuntucve 1
httpd 1
nessus 10
debiancve 1
prion 1
veracode 1
centos 1
openvas 9
redhat 1
oraclelinux 1
gentoo 1
securityvulns 1
f5
f5
K17189 : Apache HTTP server vulnerability CVE-2008-0456
2015-08-28 00:00:00
SOL17189 - Apache HTTP server vulnerability CVE-2008-0456
2015-08-28 00:00:00
ubuntucve
ubuntucve
CVE-2008-0456
2008-01-25 00:00:00
httpd
httpd
Apache Httpd < 2.2.12 : CRLF injection in mod_negotiation when untrusted uploads are supported
2008-01-15 00:00:00
nessus
nessus
F5 Networks BIG-IP : Apache HTTP server vulnerability (SOL17189)
2015-08-31 00:00:00
Apache mod_negotiation Multi-Line Filename Upload Vulnerabilities
2011-11-18 00:00:00
RHEL 5 : httpd (RHSA-2013:0130)
2013-01-08 00:00:00
debiancve
debiancve
CVE-2008-0456
2008-01-25 01:00:00
prion
prion
Crlf injection
2008-01-25 01:00:00
veracode
veracode
Arbitrary File Upload
2019-05-02 04:45:35
centos
centos
httpd, mod_ssl security update
2013-01-09 20:52:40
openvas
openvas
CentOS Update for httpd CESA-2013:0130 centos5
2013-01-21 00:00:00
RedHat Update for httpd RHSA-2013:0130-01
2013-01-11 00:00:00
RedHat Update for httpd RHSA-2013:0130-01
2013-01-11 00:00:00
redhat
redhat
(RHSA-2013:0130) Low: httpd security, bug fix, and enhancement update
2013-01-08 00:00:00
oraclelinux
oraclelinux
httpd security, bug fix, and enhancement update
2013-01-11 00:00:00
gentoo
gentoo
Apache: Multiple vulnerabilities
2008-03-11 00:00:00
securityvulns
securityvulns
About the security content of Security Update 2009-002 / Mac OS X v10.5.7
2009-05-14 00:00:00

6.2 Medium

AI Score

Confidence

Low

2.6 Low

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

0.007 Low

EPSS

Percentile

79.8%

JSON
Related for CVE-2008-0456
f52ubuntucve1httpd1nessus10debiancve1prion1veracode1centos1openvas9redhat1oraclelinux1gentoo1securityvulns1