Login Request a demo
Unscored severity · published Aug 7, 2007
CVE-2007-4164
CRLF injection vulnerability in the redirect feature in Sun Java System Web Server 6.1 and 7.0 before 20070802, when the redirect Server Application Function (SAF) uses the…
–
CVSS
2.5%
EPSS
No
On KEV
Description
CRLF injection vulnerability in the redirect feature in Sun Java System Web Server 6.1 and 7.0 before 20070802, when the redirect Server Application Function (SAF) uses the url-prefix parameter and escape is disabled, or an Error directive uses the url-prefix parameter in obj.conf, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Java System Web Server · Sun
6.1; 6.1; 6.1; 6.1; 6.1; 6.1; +3 more · source: NVD
Affected product
JS
Java System Web Server
Sun
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-4164
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-4164
Vendor Advisory
http://secunia.com/advisories/26326
sunsolve.sun.com
http://sunsolve.sun.com/search/document.do?assetkey=1-26-103003-1
Patch
http://www.securityfocus.com/bid/25190
www.securitytracker.com
http://www.securitytracker.com/id?1018504
www.vupen.com
http://www.vupen.com/english/advisories/2007/2766
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/35783
More from Java System Web Server
–
CVE-2010-0389
The admin server in Sun Java System Web Server 7.0 Update 6 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an HTTP request…
–
CVE-2010-0388
Format string vulnerability in the WebDAV implementation in webservd in Sun Java System Web Server 7.0 Update 6 allows remote attackers to cause a denial of service (daemon crash)…
–
CVE-2010-0387
Multiple heap-based buffer overflows in (1) webservd and (2) the admin server in Sun Java System Web Server 7.0 Update 7 allow remote attackers to cause a denial of service…
–
CVE-2010-0361
Stack-based buffer overflow in the WebDAV implementation in webservd in Sun Java System Web Server (aka SJWS) 7.0 Update 7 allows remote attackers to cause a denial of service…
–
CVE-2010-0360
Sun Java System Web Server (aka SJWS) 7.0 Update 7 allows remote attackers to overwrite memory locations in the heap, and discover the contents of memory locations, via a…