CVE-2023-26142
Medium
Description
All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. Header values are not properly sanitized against CRLF Injection in the set_header and add_header functions. An attacker can add the \r\n (carriage return line feeds) characters to end the HTTP response headers and inject malicious content.
SeverityMedium
CVSS6.5
Exploit probability—
ProductCrow
PublishedSep 12, 2023
First seenSep 12, 2023
Weakness typeCWE-113CWE-113
How to fix
Update
- crowcpp crow1.3.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| crowcpp crow | 1.0\+5, v < 1.3.2 | 1.3.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.