CVE-2004-2054: CRLF Injection
CRLF injection vulnerability in PhpBB 2.0.4 and 2.0.9 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via (1) the mode parameter to privmsg.php or (2) the redirect parameter to login.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2004-2054?
CVE-2004-2054 is considered a critical vulnerability due to its potential to allow HTTP Response Splitting attacks.
How do I fix CVE-2004-2054?
To fix CVE-2004-2054, upgrade PhpBB to version 2.0.10 or later which contains the necessary patches.
Which versions of PhpBB are affected by CVE-2004-2054?
CVE-2004-2054 affects PhpBB versions 2.0.1 through 2.0.9.
What are the potential impacts of CVE-2004-2054?
Exploiting CVE-2004-2054 can allow attackers to inject malicious headers, leading to content modification and session fixation.
What is HTTP Response Splitting in relation to CVE-2004-2054?
HTTP Response Splitting involves crafting responses that can manipulate how a web browser interprets content or redirects.