Vulnerability · Published Feb 3, 2024 · Assigned by GitLab
CVE-2024-1064Improper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 4
High 7.5
In plain English
A high-severity security flaw in Crafty Controller from Arcadia Technology, LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.8%top 43.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition via a modified host header
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Arcadia Technology, LLC | Crafty Controller | 4.0.0 – through 4.2.2 |
Weakness: CWE-644 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitLab Issue #327 issue-tracking