CVE-2007-4164
CRLF injection vulnerability in the redirect feature in Sun Java System Web Server 6.1 and 7.0...
CVE-2007-4164 is a high vulnerability (CVSS 7.5) in Sun Java System Web Server, published August 7, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.46%, the 84th percentile. No source names a fixed version.
CRLF injection vulnerability in the redirect feature in Sun Java System Web Server 6.1 and 7.0 before 20070802, when the redirect Server Application Function (SAF) uses the url-prefix parameter and escape is disabled, or an Error directive uses the url-prefix parameter in obj.conf, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks.
Exploit likelihood
What each source reports
NVD Score used
CRLF injection vulnerability in the redirect feature in Sun Java System Web Server 6.1 and 7.0 before 20070802, when the redirect Server Application Function (SAF) uses the url-prefix parameter and escape is disabled, or an Error directive uses the url-prefix parameter in obj.conf, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks.
- Record
CVE-2007-4164- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
CRLF injection vulnerability in the redirect feature in Sun Java System Web Server 6.1 and 7.0 before 20070802, when the redirect Server Application Function (SAF) uses the url-prefix parameter and escape is disabled, or an Error directive uses the url-prefix parameter in obj.conf, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks.
- Record
CVE-2007-4164- Updated
- 2026-11-02
EUVDEUVD-2007-4148 No score
CRLF injection vulnerability in the redirect feature in Sun Java System Web Server 6.1 and 7.0 before 20070802, when the redirect Server Application Function (SAF) uses the url-prefix parameter and escape is disabled, or an Error directive uses the url-prefix parameter in obj.conf, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks.
- Record
EUVD-2007-4148- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vcmc-mvhv-w8c3 No score
CRLF injection vulnerability in the redirect feature in Sun Java System Web Server 6.1 and 7.0...
CRLF injection vulnerability in the redirect feature in Sun Java System Web Server 6.1 and 7.0 before 20070802, when the redirect Server Application Function (SAF) uses the url-prefix parameter and escape is disabled, or an Error directive uses the url-prefix parameter in obj.conf, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks.
- Record
GHSA-vcmc-mvhv-w8c3- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | aliases, references, title | GitHub Advisories |
| 2026-11-02 | created | CVE List, NVD |
References
vupen.com/english/advisories/2007/2766
secunia.com/advisories/26326
securityfocus.com/bid/25190
exchange.xforce.ibmcloud.com/vulnerabilities/35783
sunsolve.sun.com/search/document.do?assetkey=1-26-103003-1
securitytracker.com/id?1018504
nvd.nist.gov/vuln/detail/CVE-2007-4164
github.com/advisories/GHSA-vcmc-mvhv-w8c3