CVE-2024-1064: Improper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 4
A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition via a modified host header
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Crafty Controller 4to a version that resolves this vulnerability.Fixed in 4.2.3 - Compensating control
Block requests to the Crafty Controller HTTP port to mitigate the host header injection/DoS condition.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1064?
CVE-2024-1064 is considered to have a high severity due to its potential to cause a Denial of Service (DoS) condition.
Who is affected by CVE-2024-1064?
CVE-2024-1064 affects Crafty Controller versions from 4.0.0 to 4.2.2.
How do I fix CVE-2024-1064?
To fix CVE-2024-1064, it is recommended to upgrade Crafty Controller to a version later than 4.2.2.
What kind of attack does CVE-2024-1064 allow?
CVE-2024-1064 allows a remote, unauthenticated attacker to exploit a host header injection vulnerability.
Can CVE-2024-1064 be exploited remotely?
Yes, CVE-2024-1064 can be exploited remotely by an unauthenticated attacker.