CRLF Injection

2020-01-2305:56:36

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

5.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

JSON

secure_headers is vulnerable to CRLF injection. A newline character can be used to write arbitrary value into the Content-Security-Policy header via append/override_content_security_policy_directives.

CPENameOperatorVersion
secure_headersle5.1.0
secure_headersle3.8.0
secure_headersle6.2.0
mod_xsendfileeq0.12__10.el7ui
mod_xsendfileeq0.12__10.el7sat
mod_xsendfileeq0.12__10.el7
keycloak-httpd-client-installeq0.5__1.el7
keycloak-httpd-client-installeq0.5__1.el7ost
keycloak-httpd-client-installeq0.6__3.el7
keycloak-httpd-client-installeq0.8__1.el7

Name	Operator	Version
secure_headers	le	5.1.0
secure_headers	le	3.8.0
secure_headers	le	6.2.0
mod_xsendfile	eq	0.12__10.el7ui
mod_xsendfile	eq	0.12__10.el7sat
mod_xsendfile	eq	0.12__10.el7
keycloak-httpd-client-install	eq	0.5__1.el7
keycloak-httpd-client-install	eq	0.5__1.el7ost
keycloak-httpd-client-install	eq	0.6__3.el7
keycloak-httpd-client-install	eq	0.8__1.el7