Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') (CWE-113)
HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Detection for the vulnerability has been added to Nessus (192923)
NVD published the first details for CVE-2024-24795
Feedly found the first article mentioning CVE-2024-24795. See article
Feedly estimated the CVSS score as HIGH
RedHat CVE advisory released a security advisory (CVE-2024-24795).
Detection for the vulnerability has been added to Qualys (510794)
EPSS Score was set to: 0.04% (Percentile: 7.7%)
A CVSS base score of 6.8 has been assigned.
The vulnerability CVE-2024-24795 in Apache HTTP Server allows for HTTP Response Splitting in multiple modules, posing a critical risk to web servers. This vulnerability has a CVSS score of [insert score if available], and if exploited in the wild, it could lead to unauthorized access or data manipulation. Mitigations, detections, and patches may be available, but downstream impacts to third-party vendors or technologies should be assessed. See article