Improper input validation in JavaScript Xerver HTTP Server
CVE-2009-4086
CRLF injection vulnerability in Xerver HTTP Server 4.31 and 4.32 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via certain byte sequences at the end of a URL. NOTE: some of these details are obtained from third party information.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.048 (91.0th percentile) — read the EPSS interpretation.
Affected products
- Javascript Xerver_http_server — versions 4.31, 4.32
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (Exploit, vdb-entry, x_refsource_BID)
- cve@mitre.org (Exploit, x_refsource_MISC)