Unscored severity · published Nov 29, 2009
CVE-2009-4086
CRLF injection vulnerability in Xerver HTTP Server 4.31 and 4.32 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via certain…
–
CVSS
4.8%
EPSS
No
On KEV
Description
CRLF injection vulnerability in Xerver HTTP Server 4.31 and 4.32 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via certain byte sequences at the end of a URL. NOTE: some of these details are obtained from third party information.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.8% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XH
Xerver Http Server · Javascript
4.31; 4.32 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-4086
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-4086
Exploit
http://packetstormsecurity.org/0911-exploits/xerver-split.txt
Vendor Advisory
http://secunia.com/advisories/36681
Exploit
http://www.securityfocus.com/bid/37064
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/54356