VULNERABILITY INTELLIGENCE

CVE-2018-16181

CVSS score6.1 MEDIUM

EPSS probability0.83%

CISA KEVNot currently listed

Published2019-01-09

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

HTTP header injection vulnerability in i-FILTER Ver.9.50R05 and earlier may allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks that may result in an arbitrary script injection or setting an arbitrary cookie values via unspecified vectors.

Weakness classification

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Primary references

vultures@jpcert.or.jp — Permissions Required, Vendor Advisory
vultures@jpcert.or.jp — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory