Lucene search

GitLabCVELIST:CVE-2024-1064

HistoryFeb 03, 2024 - 9:02 a.m.

CVE-2024-1064 Improper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 4

2024-02-0309:02:20

CWE-644

GitLab

www.cve.org

cve-2024-1064

host header injection

denial of service

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

49.2%

JSON

A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition via a modified host header

CNA Affected

[
  {
    "vendor": "Arcadia Technology, LLC",
    "product": "Crafty Controller",
    "versions": [
      {
        "version": "4.0.0",
        "status": "affected",
        "lessThanOrEqual": "4.2.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

gitlab.com/crafty-controller/crafty-4/-/issues/327

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

49.2%

JSON

Related for CVELIST:CVE-2024-1064