PT-2017-10940 · Ellislab+1 · Codeigniter+1

Published 2017-11-17 · Updated 2022-05-17 · CVE-2017-1000247

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions CodeIgniter version 3.1.3

Description The issue concerns HTTP Header Injection in the set status header() common function under Apache, resulting in HTTP Header Injection flaws.

Recommendations For CodeIgniter version 3.1.3, update to a newer version that contains a fix for this issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-1000247

GHSA-J9F9-8J39-4G97

Affected Products

Apache

Codeigniter

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000247 · Security Note
• https://osv.dev/vulnerability/GHSA-j9f9-8j39-4g97 · Vendor Advisory
• https://codeigniter.com/userguide3/changelog.html#version-3-1-4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000247 · Vendor Advisory
• https://github.com/codeigniter4/framework · Note