CVE-2005-1087 EXPLOIT
6.4
MEDIUM · CVSS 2.0 · EPSS 2.3% (pctl 83)
Patch early
A public exploit exists.
Description
CRLF injection vulnerability in the cmdIS.DLL plugin for AN HTTPD Server 1.42n allows remote attackers to spoof or hide entries in the logfile, and possibly read files using an injected type command, via CRLF sequences in an HTTP request.
Scoring
| CVSS | 6.4 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
| EPSS | 2.29% — more likely to be exploited than 83% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2005-04-07 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| an | an-httpd |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | AN HTTPD 1.42 - Arbitrary Log Content Injection | 2005-04-08 |
References
- http://secunia.com/advisories/14861
- http://securitytracker.com/id?1013666
- http://www.osvdb.org/15362
- http://www.security.org.sg/vuln/anhttpd142n.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/20031
- http://secunia.com/advisories/14861
- http://securitytracker.com/id?1013666
- http://www.osvdb.org/15362
- http://www.security.org.sg/vuln/anhttpd142n.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/20031
→ the Explorer · watch your stack · NVD