CVE-2017-1000247 CodeIgniter HTTP Header Injection
Attackers can inject HTTP headers via the set_status_header function in CodeIgniter, potentially bypassing security controls or causing response splitting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-1000247?
CVE-2017-1000247 is a high-severity vulnerability in n/a, published on 17 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the set_status_header() common function under Apache resulting in HTTP Header Injection flaws.
Weakness: CWE-20
Which versions are affected by CVE-2017-1000247?
2 open source packages ship an affected version, including codeigniter4/framework. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
codeigniter4/framework Packagist | From 3.1.3 | 3.1.4 |
codeigniter4/framework Packagist | From 3.1.3 | 3.1.4 |
Products include Codeigniter Codeigniter.
How do I fix CVE-2017-1000247?
Upgrade codeigniter4/framework to 3.1.4 or later.
Is CVE-2017-1000247 being exploited?
There is no known exploitation of CVE-2017-1000247 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-j9f9-8j39-4g97.