CVE-2002-1783: CRLF Injection
First published: Tue Dec 31 2002(Updated: )
CRLF injection vulnerability in PHP 4.2.1 through 4.2.3, when allow_url_fopen is enabled, allows remote attackers to modify HTTP headers for outgoing requests by causing CRLF sequences to be injected into arguments that are passed to the (1) fopen or (2) file functions.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PHP | =4.2.0 | |
| PHP | =4.1.0 | |
| PHP | =4.0.4 | |
| PHP | =4.0.5 | |
| PHP | =4.2.2 | |
| PHP | =3.0.17 | |
| PHP | =4.0.7 | |
| PHP | =4.1.1 | |
| PHP | =3.0.15 | |
| PHP | =3.0.16 | |
| PHP | =4.2.3 | |
| PHP | =4.0.6 | |
| PHP | =4.1.2 | |
| PHP | =3.0.18 | |
| PHP | =4.2.1 | |
| PHP | =4.0.3 | |
| PHP | =3.0.14 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2002-1783?
CVE-2002-1783 has a medium severity rating due to the potential for unauthorized header manipulation.
How do I fix CVE-2002-1783?
To fix CVE-2002-1783, disable the allow_url_fopen directive in your PHP configuration.
Which PHP versions are affected by CVE-2002-1783?
CVE-2002-1783 affects PHP versions 4.2.1 through 4.2.3 and several earlier versions up to 4.0.3.
What type of attack does CVE-2002-1783 enable?
CVE-2002-1783 enables remote attackers to perform CRLF injection attacks, modifying HTTP response headers.
Is CVE-2002-1783 a known vulnerability?
Yes, CVE-2002-1783 is a documented vulnerability that has been publicly disclosed since 2002.
- agent/softwarecombine
- agent/first-publish-date
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/remedy
- agent/author
- agent/references
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/php
- canonical/php
- version/php/4.2.0
- version/php/4.1.0
- version/php/4.0.4
- version/php/4.0.5
- version/php/4.2.2
- version/php/3.0.17
- version/php/4.0.7
- version/php/4.1.1
- version/php/3.0.15
- version/php/3.0.16
- version/php/4.2.3
- version/php/4.0.6
- version/php/4.1.2
- version/php/3.0.18
- version/php/4.2.1
- version/php/4.0.3
- version/php/3.0.14