CVEvulnerability
CVE-2009-4086
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-11-29
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-20
Description
CRLF injection vulnerability in Xerver HTTP Server 4.31 and 4.32 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via certain byte sequences at the end of a URL. NOTE: some of these details are obtained from third party information.
Affected configurations
• javascript xerver http server 4.31
• javascript xerver http server 4.32
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://packetstormsecurity.org/0911-exploits/xerver-split.txt Exploit
- http://secunia.com/advisories/36681 Vendor Advisory
- http://www.securityfocus.com/bid/37064 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54356 exchange.xforce.ibmcloud.com
- http://packetstormsecurity.org/0911-exploits/xerver-split.txt Exploit
- http://secunia.com/advisories/36681 Vendor Advisory
- http://www.securityfocus.com/bid/37064 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54356 exchange.xforce.ibmcloud.com