Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2008-0456
HistoryJan 25, 2008 - 1:00 a.m.

CVE-2008-0456

2008-01-2501:00:00
CWE-74
[email protected]
web.nvd.nist.gov

2.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

7.2 High

AI Score

Confidence

High

0.01 Low

EPSS

Percentile

83.4%

JSON

CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) “406 Not Acceptable” or (2) “300 Multiple Choices” HTTP response when the extension is omitted in a request for the file.

Affected configurations

NVD
Node
apachehttp_serverRange2.2.0–2.2.12
Node
redhatenterprise_linux_desktopMatch5.0
OR
redhatenterprise_linux_serverMatch5.0
OR
redhatenterprise_linux_workstationMatch5.0

References

Related

f5 2
httpd 1
ubuntucve 1
cvelist 1
nessus 10
debiancve 1
prion 1
cve 1
veracode 1
centos 1
openvas 9
redhat 1
oraclelinux 1
gentoo 1
securityvulns 1
f5
f5
K17189 : Apache HTTP server vulnerability CVE-2008-0456
2015-08-28 00:00:00
SOL17189 - Apache HTTP server vulnerability CVE-2008-0456
2015-08-28 00:00:00
httpd
httpd
Apache Httpd < 2.2.12 : CRLF injection in mod_negotiation when untrusted uploads are supported
2008-01-15 00:00:00
ubuntucve
ubuntucve
CVE-2008-0456
2008-01-25 00:00:00
cvelist
cvelist
CVE-2008-0456
2008-01-25 00:00:00
nessus
nessus
F5 Networks BIG-IP : Apache HTTP server vulnerability (SOL17189)
2015-08-31 00:00:00
Apache mod_negotiation Multi-Line Filename Upload Vulnerabilities
2011-11-18 00:00:00
RHEL 5 : httpd (RHSA-2013:0130)
2013-01-08 00:00:00
debiancve
debiancve
CVE-2008-0456
2008-01-25 01:00:00
prion
prion
Crlf injection
2008-01-25 01:00:00
cve
cve
CVE-2008-0456
2008-01-25 01:00:00
veracode
veracode
Arbitrary File Upload
2019-05-02 04:45:35
centos
centos
httpd, mod_ssl security update
2013-01-09 20:52:40
openvas
openvas
CentOS Update for httpd CESA-2013:0130 centos5
2013-01-21 00:00:00
RedHat Update for httpd RHSA-2013:0130-01
2013-01-11 00:00:00
Oracle: Security Advisory (ELSA-2013-0130)
2015-10-06 00:00:00
redhat
redhat
(RHSA-2013:0130) Low: httpd security, bug fix, and enhancement update
2013-01-08 00:00:00
oraclelinux
oraclelinux
httpd security, bug fix, and enhancement update
2013-01-11 00:00:00
gentoo
gentoo
Apache: Multiple vulnerabilities
2008-03-11 00:00:00
securityvulns
securityvulns
About the security content of Security Update 2009-002 / Mac OS X v10.5.7
2009-05-14 00:00:00

2.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

7.2 High

AI Score

Confidence

High

0.01 Low

EPSS

Percentile

83.4%

JSON
Related for NVD:CVE-2008-0456
f52httpd1ubuntucve1cvelist1nessus10debiancve1prion1cve1veracode1centos1openvas9redhat1oraclelinux1gentoo1securityvulns1