CVE-2007-2047: CRLF Injection

Published Apr 16, 2007

Updated

CRLF injection vulnerability in www/delivery/ck.php in Openads 2.3 (aka Max Media Manager, MMM) before 0.3.31-alpha-pr3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the destination parameter. NOTE: some of these details are obtained from third party information.

Affected Software

1 affected component

Openads Openads=2.3.30

Remediation

Patch Available

http://forum.openads.org/index.php?showtopic=503413399&pid=39136

Event History

Apr 16, 2007

CVE Published

10:19 PM

Apr 17, 2007

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-2047?

CVE-2007-2047 is classified as a medium severity vulnerability due to the potential for HTTP response splitting attacks.

How do I fix CVE-2007-2047?

To mitigate CVE-2007-2047, upgrade Openads to version 0.3.31-alpha-pr3 or later to address the CRLF injection vulnerability.

What impact can CVE-2007-2047 have on my system?

CVE-2007-2047 allows attackers to inject arbitrary HTTP headers, potentially leading to session hijacking and other malicious impacts.

Which versions of Openads are affected by CVE-2007-2047?

Openads versions prior to 0.3.31-alpha-pr3, including version 2.3.30, are affected by CVE-2007-2047.

Is CVE-2007-2047 a common vulnerability?

CVE-2007-2047 is considered noteworthy, particularly in older web application deployments where Openads was used.