CVE-2006-3105
CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response...
CVE-2006-3105 is a medium vulnerability (CVSS 5.0) in Bitweaver, published June 21, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.67%, the 86th percentile. No source names a fixed version.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 2.67%EPSS, 86th percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple unspecified parameters that are injected into HTTP headers, as demonstrated by the BWSESSION parameter in index.php.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Bitweaver 1.3 - 'tmpImagePath' Attachment mod_mime | 2006-06-15 |
What each source reports
NVD Score used
CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple unspecified parameters that are injected into HTTP headers, as demonstrated by the BWSESSION parameter in index.php.
- Record
CVE-2006-3105- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE ListNo score
CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple unspecified parameters that are injected into HTTP headers, as demonstrated by the BWSESSION parameter in index.php.
- Record
CVE-2006-3105- Updated
- 2026-11-02
EUVDEUVD-2006-3102No score
CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple unspecified parameters that are injected into HTTP headers, as demonstrated by the BWSESSION parameter in index.php.
- Record
EUVD-2006-3102- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r6x4-g6mq-2ww5No score
CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response...
CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple unspecified parameters that are injected into HTTP headers, as demonstrated by the BWSESSION parameter in index.php.
- Record
GHSA-r6x4-g6mq-2ww5- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
sourceforge.net/project/shownotes.php?release_id=336854&group_id=141358
retrogod.altervista.org/bitweaver_13_xpl.html
osvdb.org/26590
bitweaver.org/articles/45
securityreason.com/securityalert/1115
exchange.xforce.ibmcloud.com/vulnerabilities/27348
securityfocus.com/archive/1/437491/100/0/threaded
nvd.nist.gov/vuln/detail/CVE-2006-3105
github.com/advisories/GHSA-r6x4-g6mq-2ww5