Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveMitreCVE-2008-0456
HistoryJan 25, 2008 - 1:00 a.m.

CVE-2008-0456

2008-01-2501:00:00
CWE-74
mitre
web.nvd.nist.gov
209
cve-2008-0456
apache http server
mod_negotiation
crlf injection
vulnerability
http response splitting
nvd

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

AI Score

7.2

Confidence

High

EPSS

0.01

Percentile

83.4%

JSON

CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) “406 Not Acceptable” or (2) “300 Multiple Choices” HTTP response when the extension is omitted in a request for the file.

Affected configurations

Nvd
Node
apachehttp_serverRange2.2.0–2.2.12
Node
redhatenterprise_linux_desktopMatch5.0
OR
redhatenterprise_linux_serverMatch5.0
OR
redhatenterprise_linux_workstationMatch5.0
VendorProductVersionCPE
apachehttp_server*cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
redhatenterprise_linux_desktop5.0cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
redhatenterprise_linux_server5.0cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
redhatenterprise_linux_workstation5.0cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*

References

Related

cvelist 1
nessus 10
ubuntucve 1
f5 2
httpd 1
prion 1
nvd 1
debiancve 1
openvas 9
veracode 1
centos 1
oraclelinux 1
redhat 1
gentoo 1
securityvulns 1
cvelist
cvelist
CVE-2008-0456
2008-01-25 00:00:00
nessus
nessus
F5 Networks BIG-IP : Apache HTTP server vulnerability (SOL17189)
2015-08-31 00:00:00
Apache mod_negotiation Multi-Line Filename Upload Vulnerabilities
2011-11-18 00:00:00
RHEL 5 : httpd (RHSA-2013:0130)
2013-01-08 00:00:00
ubuntucve
ubuntucve
CVE-2008-0456
2008-01-25 00:00:00
f5
f5
K17189 : Apache HTTP server vulnerability CVE-2008-0456
2015-08-28 00:00:00
SOL17189 - Apache HTTP server vulnerability CVE-2008-0456
2015-08-28 00:00:00
httpd
httpd
Apache Httpd < 2.2.12 : CRLF injection in mod_negotiation when untrusted uploads are supported
2008-01-15 00:00:00
prion
prion
Crlf injection
2008-01-25 01:00:00
nvd
nvd
CVE-2008-0456
2008-01-25 01:00:00
debiancve
debiancve
CVE-2008-0456
2008-01-25 01:00:00
openvas
openvas
RedHat Update for httpd RHSA-2013:0130-01
2013-01-11 00:00:00
CentOS Update for httpd CESA-2013:0130 centos5
2013-01-21 00:00:00
CentOS Update for httpd CESA-2013:0130 centos5
2013-01-21 00:00:00
veracode
veracode
Arbitrary File Upload
2019-05-02 04:45:35
centos
centos
httpd, mod_ssl security update
2013-01-09 20:52:40
oraclelinux
oraclelinux
httpd security, bug fix, and enhancement update
2013-01-11 00:00:00
redhat
redhat
(RHSA-2013:0130) Low: httpd security, bug fix, and enhancement update
2013-01-08 00:00:00
gentoo
gentoo
Apache: Multiple vulnerabilities
2008-03-11 00:00:00
securityvulns
securityvulns
About the security content of Security Update 2009-002 / Mac OS X v10.5.7
2009-05-14 00:00:00

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

AI Score

7.2

Confidence

High

EPSS

0.01

Percentile

83.4%

JSON
Related for CVE-2008-0456
cvelist1nessus10ubuntucve1f52httpd1prion1nvd1debiancve1openvas9veracode1centos1oraclelinux1redhat1gentoo1securityvulns1