CVE-2008-1368
Severity:
Pending analysis
Type:
CWE-94
Code Injection
Publication date:
18/03/2008
Last modified:
23/07/2021
Description
CRLF injection vulnerability in Microsoft Internet Explorer 5 and 6 allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded CRLF (%0D%0A) before the FTP command, which causes the commands to be inserted into an authenticated FTP connection established earlier in the same browser session, as demonstrated using a DELE command, a variant or possibly a regression of CVE-2004-1166. NOTE: a trailing "//" can force Internet Explorer to try to reuse an existing authenticated connection.
Impact
Base Score 2.0
4.30
Severity 2.0
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:microsoft:internet_explorer:5:*:*:*:*:*:*:* | ||
cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page