219
Reference Description
CVE-2002-1771 CRLF injection enables spam proxy (add mail headers) using email address or
name.
https://www.cve.org/CVERecord?id=CVE-2002-1771
CVE-2002-1783 CRLF injection in API function arguments modify headers for outgoing
requests.
https://www.cve.org/CVERecord?id=CVE-2002-1783
CVE-2004-1513 Spoofed entries in web server log file via carriage returns
https://www.cve.org/CVERecord?id=CVE-2004-1513
CVE-2006-4624 Chain: inject fake log entries with fake timestamps using CRLF injection
https://www.cve.org/CVERecord?id=CVE-2006-4624
CVE-2005-1951 Chain: Application accepts CRLF in an object ID, allowing HTTP response
splitting.
https://www.cve.org/CVERecord?id=CVE-2005-1951
CVE-2004-1687 Chain: HTTP response splitting via CRLF in parameter related to URL.
https://www.cve.org/CVERecord?id=CVE-2004-1687
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 713 OWASP Top Ten 2007 Category A2 - Injection Flaws 629 2330
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER CRLF Injection
OWASP Top Ten 2007 A2 CWE More Specific Injection Flaws
WASC 24 HTTP Request Splitting
Software Fault Patterns SFP24 Tainted input to command
Related Attack Patterns
CAPEC-ID Attack Pattern Name
15 Command Delimiters
81 Web Server Logs Tampering
References
[REF-928]Ulf Harnhammar. "CRLF Injection". Bugtraq. 2002 May 7. < http://marc.info/?
l=bugtraq&m=102088154213630&w=2 >.
CWE-94: Improper Control of Generation of Code ('Code Injection')
Weakness ID : 94
Structure : Simple
Abstraction : Base
Description
The product constructs all or part of a code segment using externally-influenced input from an
upstream component, but it does not neutralize or incorrectly neutralizes special elements that
could modify the syntax or behavior of the intended code segment.
CWE Version 4.14
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')