CVE-2007-2292 Other in n/a
Remote attackers can perform HTTP request splitting via CRLF injection in Digest Authentication, potentially modifying requests or bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-2292?
CVE-2007-2292 is a medium-severity vulnerability in Microsoft Internet Explorer, published on 26 Apr 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CRLF injection vulnerability in the Digest Authentication support for Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allows remote attackers to conduct HTTP request splitting attacks via LF (%0a) bytes in the username attribute.
Weakness: CWE-20
Which versions are affected by CVE-2007-2292?
It affects 3 products.
Products include Microsoft Internet Explorer, Mozilla Firefox, Mozilla Seamonkey.
How do I fix CVE-2007-2292?
Upgrade to a fixed version.
Is CVE-2007-2292 being exploited?
There is no known exploitation of CVE-2007-2292 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Internet Explorer
- CVE-2014-1776 Microsoft Internet Explorer Memory Corruption
- CVE-2021-27085 Microsoft Internet Explorer Remote Code Execution
- CVE-2017-0222 Microsoft Internet Explorer Remote Code Execution
- CVE-2017-0210 Microsoft Internet Explorer Privilege Escalation
- CVE-2017-0149 Microsoft Internet Explorer Memory Corruption
Sources
Also known as GHSA-jjpj-fj74-73gv.