CVE-2024-5193
Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)
Summary
A vulnerability was found in Ritlabs TinyWeb Server 1.94 where the manipulation of input %0D%0A leads to crlf injection in the Request Handler component. This allows remote attackers to potentially launch attacks, and the exploit has been publicly disclosed.
Impact
Successful exploitation could allow attackers to inject malicious commands or carry out other attacks leveraging the crlf injection vulnerability in the Request Handler of Ritlabs TinyWeb Server 1.94. This could potentially lead to unauthorized access, data tampering, or other security impacts.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
The vendor was notified about this vulnerability but did not respond, so it is currently unpatched in the affected version 1.94 of Ritlabs TinyWeb Server.
Mitigation
As there is no patch available yet, mitigation steps would involve restricting network access to the vulnerable TinyWeb server, updating any input validation to prevent crlf injection, or upgrading to a newer secure version of TinyWeb Server once available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Timeline
Feedly found the first article mentioning CVE-2024-5193. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-5193
A CVSS base score of 5.3 has been assigned.
This CVE started to trend in security discussions
This CVE stopped trending in security discussions
EPSS Score was set to: 0.05% (Percentile: 15%)