CVE-2024-1064
published 2024-02-03CVE-2024-1064: A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.81%
52.2th percentile
A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition via a modified host header
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arcadia_technology_llc | crafty_controller | 4.0.0 – 4.2.2 | — |
| craftycontrol | crafty_controller | 4.0.0 – 4.2.2 | — |
| gitlab | crafty_controller | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x848-fc4r-xcw9: A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial
ghsa_unreviewed·2024-02-03
CVE-2024-1064 [HIGH] CWE-116 GHSA-x848-fc4r-xcw9: A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial
A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition via a modified host header
GitLab
Improper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 4
vendor_gitlab·2024-02-03·CVSS 7.5
CVE-2024-1064 [HIGH] CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 4
Improper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 4
A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition via a modified host header
Affected products: Crafty Controller
Affected versions: 4.0.0 (affected)
Solution: Upgrade to Crafty Controller 4.2.3 or higher OR block requests to the Crafty Controller HTTP port
Credit: Thanks to [ebartz1](https://gitlab.com/ebartz1) on GitLab for initially reporting this issue
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-02-03
Published