CWE-113: HTTP Request Splitting
The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
Also known as Improper Neutralization of CRLF Sequences in HTTP Headers, HTTP Response Splitting.
A kind of CWE-93 CRLF Injection.
From the CWE List. © The MITRE Corporation.
Newest
- apache http serverApache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting5.3 Medium
- fortinet fortiwebAn improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting')...5.3 Medium
- netty, debian linux +1 moreNetty vulnerable to HTTP Response splitting from assigning header value iterator6.5 Medium
- cisco secure email, secure email and web manager, email security appliance firmware +1 more +3 moreA vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager...4.7 Medium
- apple swiftnioSwiftNIO vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')7.5 High
- ge workstationstWorkstationST - Response Splitting in AM Gateway Challenge-Response4.7 Medium
- hitachi energy msm, hitachienergy modular switchgear monitoring firmware +1 moreHTTP Response Splitting in Hitachi Energy’s MSM Product5.0 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: J-Web has an Improper Neutralization of CRLF Sequences in its HTTP Headers which allows an attacker to carry out multiple types of attacks.8.8 High
- gin-gonic gin, github.com/gin-gonic/gin +1 moreHTTP Response Splitting7.1 High
- cisco web security appliance (wsa), content security management appliance, web security appliance +2 moreCisco Web Security Appliance and Cisco Content Security Management Appliance HTTP Header Injection Vulnerability4.7 Medium
- linuxfoundation ceph, red hat ceph storage, canonical ubuntu linux +3 more +5 moreA flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is...5.4 Medium
- pumaHTTP Response Splitting (Early Hints) in Puma6.5 Medium
- puma, ruby-lang ruby, debian linux +1 more +3 moreHTTP Response Splitting in Puma6.5 Medium
- snyk wso2 transport-http, wso2 transport-http +1 moreHTTP Response Splitting in WSO2 transport-http6.5 Medium
- twitter secure headersLimited header injection when using dynamic overrides with user input in RubyGems secure_headers4.4 Medium
- line armeriaImproper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Armeria4.8 Medium
- cisco unified contact center expressCisco Unified Contact Center Express HTTP Response Splitting Vulnerability6.1 Medium
- my-netdata netdataAn issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data...6.1 Medium
- daj i-filterHTTP header injection vulnerability in i-FILTER Ver.9.50R05 and earlier may allow remote...6.1 Medium
- epson ds-570w firmware, ds-780n firmware, ep-10va firmware +56 more +58 moreHTTP header injection vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware...8.8 High
- siemens simatic wincc runtime, simatic hmi comfort outdoor panels firmware, simatic hmi comfort panels firmware +10 more +12 moreA vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V14),...8.8 High
- yunohostThe YunoHost 2.7.2 through 2.7.14 web application is affected by one HTTP Response Header...8.8 High
- schneider electric se embedded web servers in all modicon m340, premium, quantum plcs and bmxnor0200, schneider-electric modicom bmxnor0200h firmware, modicom m340 firmware +2 more +4 moreImproper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')...7.5 High
- monstraMonstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg...6.1 Medium
- samsung, samsung sth-eth-250 firmware +1 moreAn exploitable HTTP header injection vulnerability exists in the remote servers of Samsung...8.6 High
- red hat ansible tower, redhat cloudforms management engine +1 moreAnsible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF...5.2 Medium
- [unknown] undertow, redhat jboss enterprise application platform, virtualization host +2 moreImproper Neutralization of CRLF Sequences in HTTP Headers in Undertow5.4 Medium
- ruby-lang ruby, debian linux +1 moreRuby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0...5.3 Medium
- cisco esw2-350g-52 firmware, esw2-350g-52dc firmware, esw2-550x-48 firmware +82 more +84 moreA vulnerability in the web framework of Cisco Small Business Managed Switches software could...6.1 Medium
- ibm security guardiumIBM Security Guardium 10.0 is vulnerable to HTTP response splitting attacks. A remote attacker...6.1 Medium
- cisco email security appliance, email security appliance firmware +1 moreA vulnerability in the Cisco Email Security Appliance (ESA) could allow an unauthenticated,...5.3 Medium
- fli4lHTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30.7.2 High
- apt-cacher-ng project apt-cacher-ng, apt-cacher project apt-cacher +1 moreapt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded...6.1 Medium
- intel virusscan enterprise linux (vsel), mcafee virusscan enterprise +1 moreImproper neutralization of CRLF sequences in HTTP headers vulnerability in Intel Security...8.1 High
- nodejs node.js, suse linux enterprise +1 moreCRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0...6.1 Medium
- redhat jboss enterprise application platform, jboss wildfly application server +1 moreImproper Neutralization of CRLF Sequences in Wildfly Undertow6.1 Medium
- huawei fusionaccessCRLF injection vulnerability in Huawei FusionAccess before V100R006C00 allows remote attackers to...6.1 Medium
- pythonCRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in...6.1 Medium
- drupal, debian linux +1 moreDrupal CRLF injection vulnerability in the drupal_set_header function5.9 Medium
- jenkins, redhat openshift +1 moreJenkins has CRLF Injection Vulnerability in the CLI6.1 Medium
- cisco headend digital broadband delivery systemCRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in...4.3 Medium
- apache tomcatImproper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat4.3 Medium
- cloudbees jenkinsJenkins allows HTTP Injection and Response Splitting4.3 Medium
- moodleMoodle CRLF Injection Vulnerability in Calendar Component5.0 Medium
- phpmyadminphpMyAdmin HTTP Response Splitting Vulnerability7.5 High
- drupalCRLF injection vulnerability in the drupal_goto function in includes/common.inc Drupal 4.7.x...5.1 Medium