Lucene search
SnykCVELIST:CVE-2023-26148HistorySep 29, 2023 - 5:00 a.m.
CVE-2023-26148
2023-09-2905:00:03
snyk
www.cve.org
3
crlf injection
untrusted user input
request headers
additional headers
cve-2023-26148
CVSS3
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P
EPSS
0.001
Percentile
21.7%
All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers. An attacker can add the \r\n (carriage return line feeds) characters and inject additional headers in the request sent.
CNA Affected
[
{
"product": "ithewei/libhv",
"versions": [
{
"version": "0",
"lessThan": "*",
"status": "affected",
"versionType": "semver"
}
],
"vendor": "n/a"
}
]Related
prion
prion
Crlf injection
2023-09-29 05:15:00
nvd
nvd
CVE-2023-26148
2023-09-29 05:15:46
cve
cve
CVE-2023-26148
2023-09-29 05:15:46
CVSS3
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P
EPSS
0.001
Percentile
21.7%
Related for CVELIST:CVE-2023-26148