CVE-2024-45687 HTTP Server incorrectly accepting disallowed characters within header values
Attackers can inject CRLF sequences into HTTP headers to manipulate state or spoof identity in Payara Server and Micro.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-45687?
CVE-2024-45687 is a low-severity vulnerability in Payara Micro, published on 21 Jan 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Management Interface modules), Payara Platform Payara Micro (Grizzly modules) allows Manipulating State, Identity Spoofing.This issue affects Payara Server: from 4.1.151 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0; Payara Micro: from 4.1.152 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0.
Weakness: CWE-113
Which versions are affected by CVE-2024-45687?
How do I fix CVE-2024-45687?
No fix has been published for CVE-2024-45687 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-45687 being exploited?
There is no known exploitation of CVE-2024-45687 in the wild and no public exploit code.
Sources
Also known as GHSA-mqh5-c2wx-v3pq.