Unscored severity · published Sep 4, 2008
CVE-2008-3906
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF…
–
CVSS
7.1%
EPSS
No
On KEV
Description
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.1% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Mono · Mono
1.0; 1.0.5; 1.1.4; 1.1.8.3; 1.1.13; 1.1.13.4; +6 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-3906
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-3906
Vendor Advisory
http://secunia.com/advisories/31643
secunia.com
http://secunia.com/advisories/36494
wiki.rpath.com
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0286
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2008:210
www.openwall.com
http://www.openwall.com/lists/oss-security/2008/08/27/6
www.securityfocus.com
http://www.securityfocus.com/archive/1/496845/100/0/threaded
More from Mono
–
CVE-2012-3382
Cross-site scripting (XSS) vulnerability in the ProcessRequest function in mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs in Mono 2.10.8 and earlier allows remote…
–
CVE-2011-0992
Use-after-free vulnerability in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote attackers to cause a denial of service (plugin crash) or obtain…
–
CVE-2011-0991
Use-after-free vulnerability in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote attackers to cause a denial of service or possibly have…
–
CVE-2011-0990
Race condition in the FastCopy optimization in the Array.Copy method in metadata/icall.c in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote…
–
CVE-2011-0989
The RuntimeHelpers.InitializeArray method in metadata/icall.c in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, does not properly restrict data types, which…