title: Multiple vulnerabilities in Rejetto's Http File Server
description: The software does not neutralize or incorrectly neutralizes certain characters before the data is included in outgoing HTTP headers. The inclusion of invalidated data in an HTTP header allows an attacker to specify the full HTTP response represented by the browser. An attacker could control the response and craft attacks such as cross-site scripting and cache poisoning attacks.
problem types: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
affected:
{
defaultStatus: unaffected
product: Http File Server
vendor: Rejetto
versions:
status: affected, version: 2.2a, build #124
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
The vulnerability has been fixed in subsequent versions. The affected version is not currently supported.