CVE-2016-6484

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

CRLF injection vulnerability in Infoblox Network Automation NetMRI before 7.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the contentType parameter in a login action to config/userAdmin/login.tdf.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-93

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/138615/Infoblox-7.0.1-CRLF-Injection-HTTP-Response-Splitting.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/539366/100/0/threaded
http://www.securityfocus.com/bid/92794Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036736Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/138615/Infoblox-7.0.1-CRLF-Injection-HTTP-Response-Splitting.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/539366/100/0/threaded
http://www.securityfocus.com/bid/92794Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036736Third Party Advisory, VDB Entry

Timeline

Published: Jan 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-64857.5The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initi CVE-2016-64867.8Siemens SINEMA Server uses weak permissions for the application folder, which allows local users to gain privileges via unspecified vectors.CVE-2016-64897.5The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side channel attack.CVE-2016-64904.4The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of CVE-2016-64918.8Buffer overflow in the Get8BIMProperty function in MagickCore/property.c in ImageMagick before 6.9.5-4 and 7.x before 7.0.2-6 allows remote CVE-2016-64927.8The MT6573FDVT_SetRegHW function in camera_fdvt.c in the MediaTek driver for Linux allows local users to gain privileges via a crafted appli CVE-2016-64939.8Citrix XenApp 6.x before 6.5 HRP07 and 7.x before 7.9 and Citrix XenDesktop before 7.9 might allow attackers to weaken an unspecified securi CVE-2016-64945.5The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive informati CVE-2016-64955.9NetApp Data ONTAP before 8.2.4P5, when operating in 7-Mode, allows remote attackers to obtain information about the volumes configured for H CVE-2016-64969.8The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an CVE-2016-64977.5main/java/org/apache/directory/groovyldap/LDAP.java in the Groovy LDAP API in Apache allows attackers to conduct LDAP entry poisoning attack CVE-2016-65008.1Unspecified methods in the RACF Connector component before 1.1.1.0 in ForgeRock OpenIDM and OpenICF improperly call the SearchControls const