CVE-2023-48256
EUVD-2023-5232510.01.2024, 13:15
The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s session via a crafted URL or HTTP request.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| bosch | nexo-os | 1000 ≤ 𝑥 ≤ 1500-sp2 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')The software receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
- CWE-436 - Interpretation ConflictProduct A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.