Improper Neutralization of CRLF Sequences in ManageEngine Desktop Central

CVE-2023-4768

6.1MEDIUM

Key Information

Vendor
Manageengine
Status
Desktop Central
Vendor
CVE Published:
3 November 2023

Summary

A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via the fileName parameter in /STATE_ID/1613157927228/InvSWMetering.pdf.

Affected Version(s)

Desktop Central = 9.1.0

Refferences

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database

Credit

Rafael Pedrero
.