CVE-2020-24275

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A HTTP response header injection vulnerability in Swoole v4.5.2 allows attackers to execute arbitrary code via supplying a crafted URL.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.cal1.cn/post/HTTP%20Response%20Header%20Injection%20in%20Swoole%3C%3D4.5.2Exploit, Third Party Advisory
https://github.com/swoole/swoole-src/pull/3539Patch, Vendor Advisory
https://github.com/swoole/swoole-src/pull/3545Patch, Vendor Advisory
https://portswigger.net/kb/issues/00200200_http-response-header-injectionTechnical Description
https://blog.cal1.cn/post/HTTP%20Response%20Header%20Injection%20in%20Swoole%3C%3D4.5.2Exploit, Third Party Advisory
https://github.com/swoole/swoole-src/pull/3539Patch, Vendor Advisory
https://github.com/swoole/swoole-src/pull/3545Patch, Vendor Advisory
https://portswigger.net/kb/issues/00200200_http-response-header-injectionTechnical Description

Timeline

Published: Jul 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-242857.5INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 allows an attacker to obtain sensitive information through /cgi-bin/cgiServer.exx.CVE-2020-242928.8Buffer Overflow vulnerability in load function in PluginICO.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary code vi CVE-2020-242938.8Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary co CVE-2020-242946.5Buffer Overflow vulnerability in psdParser::UnpackRLE function in PSDParser.cpp in FreeImage 3.19.0 [r1859] allows remote attackers to cuase CVE-2020-242958.8Buffer Overflow vulnerability in PSDParser.cpp::ReadImageLine() in FreeImage 3.19.0 [r1859] allows remote attackers to ru narbitrary code vi CVE-2020-242978.8httpd on TP-Link TL-WPA4220 devices (versions 2 through 4) allows remote authenticated users to execute arbitrary OS commands by sending cra CVE-2020-243016.1Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allo CVE-2020-243036.1Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.CVE-2020-243077.8An issue in mRemoteNG v1.76.20 allows attackers to escalate privileges via a crafted executable file. NOTE: third parties were unable to rep CVE-2020-243127.5mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fm_backups directory with a .htaccess file. This result CVE-2020-243136.1Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "Appointmen CVE-2020-243146.1Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside