1. Home
  2. CVE Database
  3. CVE-2018-1067
MEDIUM · 6.1

CVE-2018-1067

In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also re...

Vulnerability Description

In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.

CVSS Score

6.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
RedhatUndertow< 1.4.25
RedhatJboss Enterprise Application Platform7.1
RedhatEnterprise Linux6.0
RedhatVirtualization Host4.0

Related Weaknesses (CWE)

CWE-113

References

FAQ

What is CVE-2018-1067?

CVE-2018-1067 is a vulnerability with a CVSS score of 6.1 (MEDIUM). In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also re...

How severe is CVE-2018-1067?

CVE-2018-1067 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-1067?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Undertow, Redhat Jboss Enterprise Application Platform, Redhat Enterprise Linux, Redhat Virtualization Host.