Back to CVE Browser

CVE-2016-6484

MEDIUM

6.1

CVSS Severity Score

EPSS Score0.1860%

EPSS Percentile38.32th

PublishedJan 23, 2017

Last ModifiedMay 13, 2026

Vulnerability Description

CRLF injection vulnerability in Infoblox Network Automation NetMRI before 7.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the contentType parameter in a login action to config/userAdmin/login.tdf.

Affected Platforms (CPE)

📦

Infoblox

Netmri

<= 7.0.1

References & Advisories

🔗 http://packetstormsecurity.com/files/138615/Infoblox-7.0.1-CRLF-Injection-HTTP-Response-Splitting.html

🔗 http://www.securityfocus.com/archive/1/539366/100/0/threaded

🔗 http://www.securityfocus.com/bid/92794

🔗 http://www.securitytracker.com/id/1036736

🔗 http://packetstormsecurity.com/files/138615/Infoblox-7.0.1-CRLF-Injection-HTTP-Response-Splitting.html

🔗 http://www.securityfocus.com/archive/1/539366/100/0/threaded

🔗 http://www.securityfocus.com/bid/92794

🔗 http://www.securitytracker.com/id/1036736

Related Vulnerabilities

CVE-2014-341810.0

config/userAdmin/login.tdf in Infoblox NetMRI before 6.8.5 allows remote attackers to execute arbitrary commands via shell metacha...

CVE-2015-203310.0

Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands wit...

CVE-2014-34197.2

Infoblox NetMRI before 6.8.5 has a default password of admin for the "root" MySQL database account, which makes it easier for loca...

CVE-2018-66436.1

Infoblox NetMRI 7.1.1 has Reflected Cross-Site Scripting via the /api/docs/index.php query parameter.