Crlf injection

2023-11-0311:15:00

PRIOn knowledge base

www.prio-n.com

crlf injection

manageengine desktop central

version 9.1.0

remote attacker

http headers

http response splitting

filename parameter

6.3 Medium

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

75.6%

JSON

A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via the fileName parameter in /STATE_ID/1613157927228/InvSWMetering.pdf.

CPENameOperatorVersion
manageengine_desktop_centraleq9.1.0

CPE	Name	Operator	Version
	manageengine_desktop_central	eq	9.1.0

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-manageengine-desktop-central