CVE-2011-5279

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

CRLF injection vulnerability in the CGI implementation in Microsoft Internet Information Services (IIS) 4.x and 5.x on Windows NT and Windows 2000 allows remote attackers to modify arbitrary uppercase environment variables via a \n (newline) character in an HTTP header.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://hi.baidu.com/yuange1975/item/b2cc7141c22108e91e19bc2eThird Party Advisory
http://seclists.org/fulldisclosure/2012/Apr/0Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2012/Apr/13Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2014/Apr/108Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2014/Apr/128Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2014/Apr/247Exploit, Mailing List, Third Party Advisory
http://hi.baidu.com/yuange1975/item/b2cc7141c22108e91e19bc2eThird Party Advisory
http://seclists.org/fulldisclosure/2012/Apr/0Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2012/Apr/13Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2014/Apr/108Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2014/Apr/128Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2014/Apr/247Exploit, Mailing List, Third Party Advisory

Timeline

Published: Apr 23, 2014
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-52805.0Multiple stack-based buffer overflows in BOINC 6.13.x allow remote attackers to cause a denial of service (crash) via a long trickle-up to (CVE-2011-52825.3mIRC prior to 7.22 has a message leak because chopping of outbound messages is mishandled.CVE-2011-52834.3Cross-site scripting (XSS) vulnerability in the web management interface in httpd/cgi-bin/ipinfo.cgi in Smoothwall Express 3.1 and 3.0 SP3 a CVE-2011-52846.8Cross-site request forgery (CSRF) vulnerability in the web management interface in httpd/cgi-bin/shutdown.cgi in Smoothwall Express 3.1 and CVE-2011-52854.3Multiple cross-site scripting (XSS) vulnerabilities in BugFree 2.1.3 allow remote attackers to inject arbitrary web script or HTML via (1) t CVE-2011-52867.5SQL injection vulnerability in social-slider-2/ajax.php in the Social Slider plugin before 7.4.2 for WordPress allows remote attackers to ex CVE-2011-52874.3Multiple cross-site scripting (XSS) vulnerabilities in HESK before 2.4.1 allow remote attackers to inject arbitrary web script or HTML via t CVE-2011-52889.3Multiple buffer overflows in the ThreeDify.ThreeDifyDesigner.1 ActiveX control in ActiveSolid.dll in ThreeDify Designer 5.0.2 allow remote a CVE-2011-52896.4The SaveDecrypted method in the ChilkatCrypt2.ChilkatOmaDrm.1 ActiveX control in ChilkatCrypt2.dll in aTube Catcher 2.3.570 allows remote at CVE-2011-52906.4The SaveToFile method in the UniBasicPack.UniTextBox ActiveX control in UniBasic100_EDA1811C.ocx in IDrive Online Backup 3.4.0 allows remote CVE-2011-52916.4The SaveData method in the Cygnicon.ViewControl.1 ActiveX control in CyViewer.ocx in Ashampoo 3D CAD Professional 3.x before 3.0.2 allows re CVE-2011-52927.5The EaseWeFtp.FtpLibrary ActiveX control in EaseWeFtp.ocx in Easewe FTP OCX 4.5.0.9 does not restrict access to certain methods, which allow