CVE-2020-3246 Cisco Umbrella Carriage Return Line Feed Injection Vulnerability
An attacker can inject arbitrary HTTP headers into responses via a crafted URL, potentially bypassing security controls in Cisco Umbrella.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-3246?
CVE-2020-3246 is a medium-severity vulnerability in Cisco Umbrella, published on 6 May 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in the web server of Cisco Umbrella could allow an unauthenticated, remote attacker to perform a carriage return line feed (CRLF) injection attack against a user of an affected service. The vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user to access a crafted URL. A successful exploit could allow the attacker to inject arbitrary HTTP headers into valid HTTP responses sent to the browser of the user.
Which versions are affected by CVE-2020-3246?
It affects 1 product.
Products include Cisco Umbrella.
How do I fix CVE-2020-3246?
No fix has been published for CVE-2020-3246 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-3246 being exploited?
There is no known exploitation of CVE-2020-3246 in the wild and no public exploit code.
Other vulnerabilities in Cisco Umbrella
- CVE-2018-0435 Cisco Umbrella API Unauthorized Access Vulnerability
- CVE-2019-1807 Cisco Umbrella Dashboard Session Management Vulnerability
- CVE-2021-1474 Cisco Umbrella Link and CSV Formula Injection Vulnerabilities
- CVE-2021-1475 Cisco Umbrella Link and CSV Formula Injection Vulnerabilities
- CVE-2019-1792 Cisco Umbrella Cross-Site Scripting Vulnerability
Sources
Also known as GHSA-j53q-vx25-fmqm.