Vulnerability Details : CVE-2008-1770

CRLF injection vulnerability in Akamai Download Manager ActiveX control before 2.2.3.6 allows remote attackers to force the download and execution of arbitrary files via a URL parameter containing an encoded LF followed by a malicious target line.

Published 2008-06-04 21:32:00

Updated 2018-10-11 20:36:46

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2008-1770

Probability of exploitation activity in the next 30 days: 18.47%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 96 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2008-1770

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	[email protected]
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2008-1770

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Assigned by: [email protected] (Primary)

References for CVE-2008-1770

Products affected by CVE-2008-1770

Akamai » Download Manager
Versions up to, including, (<=) 2.2.3.5
cpe:2.3:a:akamai:download_manager:*:*:*:*:*:*:*:*
Matching versions
Akamai » Download Manager » Version: 2.2.1.0
cpe:2.3:a:akamai:download_manager:2.2.1.0:*:*:*:*:*:*:*
Matching versions
Akamai » Download Manager » Version: 2.0.4.4
cpe:2.3:a:akamai:download_manager:2.0.4.4:*:*:*:*:*:*:*
Matching versions
Akamai » Download Manager » Version: 2.2.0.0
cpe:2.3:a:akamai:download_manager:2.2.0.0:*:*:*:*:*:*:*
Matching versions