CVE-2008-3906
Estado: ModificadaMedia (4.3)—
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
- Puntuación base: 4.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 7.10%
- Percentil entre todas las CVEs puntuadas: 94
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-20
Referencias
- http://secunia.com/advisories/31643
- http://secunia.com/advisories/36494
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0286
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:210
- http://www.openwall.com/lists/oss-security/2008/08/27/6
- http://www.securityfocus.com/archive/1/496845/100/0/threaded
- http://www.securityfocus.com/bid/30867
- http://www.vupen.com/english/advisories/2008/2443
- https://bugzilla.novell.com/show_bug.cgi?id=418620
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44740
- https://usn.ubuntu.com/826-1/
- http://secunia.com/advisories/31643
- http://secunia.com/advisories/36494
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0286
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:210
- http://www.openwall.com/lists/oss-security/2008/08/27/6
- http://www.securityfocus.com/archive/1/496845/100/0/threaded
- http://www.securityfocus.com/bid/30867
- http://www.vupen.com/english/advisories/2008/2443
- https://bugzilla.novell.com/show_bug.cgi?id=418620
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44740
- https://usn.ubuntu.com/826-1/
JSON original (NVD)
Mostrar
{
"id": "CVE-2008-3906",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2008-09-04T17:41:00.000",
"references": [
{
"url": "http://secunia.com/advisories/31643",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/36494",
"source": "cve@mitre.org"
},
{
"url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0286",
"source": "cve@mitre.org"
},
{
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:210",
"source": "cve@mitre.org"
},
{
"url": "http://www.openwall.com/lists/oss-security/2008/08/27/6",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/archive/1/496845/100/0/threaded",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/30867",
"tags": [
"Exploit"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2008/2443",
"source": "cve@mitre.org"
},
{
"url": "https://bugzilla.novell.com/show_bug.cgi?id=418620",
"source": "cve@mitre.org"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44740",
"source": "cve@mitre.org"
},
{
"url": "https://usn.ubuntu.com/826-1/",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/31643",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/36494",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0286",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:210",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2008/08/27/6",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/496845/100/0/threaded",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/30867",
"tags": [
"Exploit"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2008/2443",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugzilla.novell.com/show_bug.cgi?id=418620",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44740",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://usn.ubuntu.com/826-1/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyección CRLF en Sys.Web en Mono 2.0 y anteriores, permite a atacantes remotos inyectar cabeceras HTTP de su elección y llevar a cabo ataques de división de respuesta HTTP mediante secuencias CRLF en la cadena de consulta(query)."
}
],
"lastModified": "2026-06-16T22:56:46.923",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mono:mono:1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B31A3175-7CC6-4367-9A3C-F3324156C818"
},
{
"criteria": "cpe:2.3:a:mono:mono:1.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DBB77289-2AED-4BD4-9578-FEB0EC83701E"
},
{
"criteria": "cpe:2.3:a:mono:mono:1.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A4299404-6C79-4B21-BB8C-115FA1E3AC28"
},
{
"criteria": "cpe:2.3:a:mono:mono:1.1.8.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "919CAD10-2F17-4F94-8116-815E77F5E998"
},
{
"criteria": "cpe:2.3:a:mono:mono:1.1.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "19877D33-5DBF-40D7-87CB-545558C64771"
},
{
"criteria": "cpe:2.3:a:mono:mono:1.1.13.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F64E7267-E010-4FC8-879A-448C85BC250B"
},
{
"criteria": "cpe:2.3:a:mono:mono:1.1.13.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "683F75A5-E4E4-4416-8E1C-A2C694A30BA3"
},
{
"criteria": "cpe:2.3:a:mono:mono:1.1.13.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EBE3CDD7-8553-4CB7-A0A7-B059B4D75B0C"
},
{
"criteria": "cpe:2.3:a:mono:mono:1.1.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DE2C11F2-2A21-481E-8350-F3777A0A8033"
},
{
"criteria": "cpe:2.3:a:mono:mono:1.1.17.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EFC21FA7-648F-4E41-962B-664140FA4812"
},
{
"criteria": "cpe:2.3:a:mono:mono:1.1.18:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A9FF02E9-070C-4AAA-ABB7-26FC9E56C7A2"
},
{
"criteria": "cpe:2.3:a:mono:mono:1.2.5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EC72C972-FF09-4A5D-9AD4-A422EDADF5AF"
},
{
"criteria": "cpe:2.3:a:mono_project:mono:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F33FED4-EE33-41EF-8B24-F751D0A9891B",
"versionEndIncluding": "2.0"
},
{
"criteria": "cpe:2.3:a:mono_project:mono:1.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "403E554C-FD1B-42CE-82C2-43CC191905DE"
},
{
"criteria": "cpe:2.3:a:mono_project:mono:1.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "78278FE6-26EA-4E89-9423-EABA6C4D8877"
},
{
"criteria": "cpe:2.3:a:mono_project:mono:1.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "15E1695E-FD6E-4602-9BD9-9CFFF20574CA"
},
{
"criteria": "cpe:2.3:a:mono_project:mono:1.2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "691B3AF1-7F3F-4A7D-9F16-FE6044E33482"
},
{
"criteria": "cpe:2.3:a:mono_project:mono:1.2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E2DE3739-A2ED-47D7-9AE9-442A95ACFC3A"
},
{
"criteria": "cpe:2.3:a:mono_project:mono:1.2.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DDAB5331-AD2E-483C-93C3-8095BBBA0572"
},
{
"criteria": "cpe:2.3:a:mono_project:mono:1.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E3CC03DC-14A6-4C45-9511-7CE8E7F727BB"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}