Description
Multiple CRLF injection vulnerabilities in webadmin in ZNC before 0.066 allow remote authenticated users to modify the znc.conf configuration file and gain privileges via CRLF sequences in the quit message and other vectors.
References (7)
Core 7
Core References
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/34230
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2009/dsa-1735
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2009/03/01/2
Vendor Advisory x_refsource_confirm
http://znc.svn.sourceforge.net/viewvc/znc?view=rev&sortby=rev&sortdir=down&revision=1395
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/52295
Vendor Advisory x_refsource_confirm
http://znc.svn.sourceforge.net/viewvc/znc/trunk/modules/webadmin.cpp?view=log&sortby=rev&sortdir=down&pathrev=1395
Vendor Advisory x_refsource_confirm
http://znc.svn.sourceforge.net/viewvc/znc?view=rev&sortby=rev&sortdir=down&revision=1396
Scores
EPSS
0.0209
EPSS Percentile
79.4%
Details
CWE
CWE-94
Status
published
Products (3)
znc/znc
0.056
znc/znc
0.058
znc/znc
< 0.062
Published
Mar 03, 2009
Tracked Since
Feb 18, 2026