CVE-2024-1226

HIGH

Rejetto HTTP File Server 2.2a - HTTP Response Splitting

Title source: manual

Description

The software does not neutralize or incorrectly neutralizes certain characters before the data is included in outgoing HTTP headers. The inclusion of invalidated data in an HTTP header allows an attacker to specify the full HTTP response represented by the browser. An attacker could control the response and craft attacks such as cross-site scripting and cache poisoning attacks.

References (1)

Core 1

Core References

Third Party Advisory

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-rejettos-http-file-server

Scores

CVSS v3 7.5

EPSS 0.0045

EPSS Percentile 35.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-93

Status published

Products (1)

Rejetto/Http File Server 2.2a, build #124

Published Mar 12, 2024

Tracked Since Feb 18, 2026