CVE-2016-8024: intel virusscan enterprise linux (vsel) HTTP Request/Response Splitting

Vulnerability summary

CVE-2016-8024 is a high (CVSS 8.1) HTTP Request/Response Splitting vulnerability in intel virusscan enterprise linux (vsel). EPSS estimates a 8.67% chance of exploitation in the next 30 days, higher than 95% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 14-03-2017
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Improper neutralization of CRLF sequences in HTTP headers vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to obtain sensitive information via the server HTTP response spoofing.

• CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.