CVE-2024-5193: Ritlabs TinyWeb Server Request crlf injection

Published May 22, 2024

Updated

A security vulnerability has been detected in Ritlabs TinyWeb Server 1.94. This vulnerability affects unknown code of the component Request Handler. The manipulation with the input %0D%0A leads to crlf injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.99 is able to resolve this issue. The identifier of the patch is d49c3da6a97e950975b18626878f3ee1f082358e. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Ritlabs TinyWeb Server

Ritlabs TinyWeb=1.94

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ritlabs TinyWeb Server to a version that resolves this vulnerability.
Fixed in 1.99Patch d49c3da6a97e950975b18626878f3ee1f082358e

Event History

May 22, 2024

CVE Published

via MITRE·10:31 AM

Data Sourced

via MITRE·10:31 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:15 AM

DescriptionSeverityWeaknessAffected Software

May 4, 57984

Event

via NVD·08:27 AM

Frequently Asked Questions

What is the severity of CVE-2024-5193?

CVE-2024-5193 has been classified as a problematic vulnerability.

How do I fix CVE-2024-5193?

To fix CVE-2024-5193, ensure you are using the latest version of Ritlabs TinyWeb Server that addresses this vulnerability.

What kind of attack can be executed using CVE-2024-5193?

CVE-2024-5193 can be exploited to perform a CRLF injection attack remotely.

Which component is affected by CVE-2024-5193?

CVE-2024-5193 affects an unknown function of the Request Handler component in Ritlabs TinyWeb Server.

Are there known exploits for CVE-2024-5193?

Yes, exploits for CVE-2024-5193 have been documented and can be executed remotely.