Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).
Severity
6.1MEDIUM
EPSS
73.3%
top 1.21%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedAug 14
Latest updateMay 13
Description
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7
Affected Packages3 packages
▶CVEListV5apache_software_foundation/apache_http_serverFixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31), Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23)+1
🔴Vulnerability Details
3💥Exploits & PoCs
1Nuclei▶
Apache mod_userdir CRLF injection