9.8crit
CVE-2018-11652in critical feed1 exploit
CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an H…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
23.6%
percentile 98%
Public exploits
1
Exploit-DB
Summary
CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report.
Exploit prediction (EPSS)
23.64% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.
Exploits and detections
- EDB-44899 Nikto 2.1.6 - CSV Injection · local · 2018-06-18
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
- CWE-1236 Improper Neutralization of Formula Elements in a CSV File
References
- github.com /sullo/nikto/commit/e759b3300aace5314fe3d30800c8bd83c81c29f7 · x_refsource_MISC, x_transferred
- exploit-db.com /exploits/44899/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
Sources
- CVE List: CVE-2018-11652
- NVD: CVE-2018-11652
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.