CVE-2024-1226
Published: 12 March 2024
Summary
CVE-2024-1226 is a high-severity CRLF Injection (CWE-93) vulnerability in Incibe (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, ranked at the 30.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-16993
- 🇪🇸 INCIBE: www.incibe.es
Vulnerability details
The software does not neutralize or incorrectly neutralizes certain characters before the data is included in outgoing HTTP headers. The inclusion of invalidated data in an HTTP header allows an attacker to specify the full HTTP response represented by the…
more
browser. An attacker could control the response and craft attacks such as cross-site scripting and cache poisoning attacks.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.