Description
CRLF injection vulnerability in the CGI implementation in Microsoft Internet Information Services (IIS) 4.x and 5.x on Windows NT and Windows 2000 allows remote attackers to modify arbitrary uppercase environment variables via a \n (newline) character in an HTTP header.
References (6)
Core 6
Core References
Exploit, Mailing List, Third Party Advisory mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Apr/247
Exploit, Mailing List, Third Party Advisory mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Apr/128
Exploit, Mailing List, Third Party Advisory mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2012/Apr/0
Exploit, Mailing List, Third Party Advisory mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Apr/108
Third Party Advisory x_refsource_misc
http://hi.baidu.com/yuange1975/item/b2cc7141c22108e91e19bc2e
Exploit, Mailing List, Third Party Advisory mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2012/Apr/13
Scores
EPSS
0.1897
EPSS Percentile
97.0%
Details
Status
published
Products (2)
microsoft/internet_information_services
4.0
microsoft/internet_information_services
5.0
Published
Apr 23, 2014
Tracked Since
Feb 18, 2026