414 – Insecure service configuration - Header Checking
Description
The application disables the HeaderChecking property, which enables the encoding of newlines and carriage returns, thus allowing the injection of malicious headers
Impact
Ease header injection attacks through newlines and carriage returns
Recommendation
Set the EnableHeaderChecking property to true, of remove the line that sets the property in false, since its default value is true
Threat
Anonymous attacker from the Internet
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: N
- Attack complexity: H
- Attack Requirements: N
- Privileges required: N
- User interaction: P
- Confidentiality (VC): N
- Integrity (VI): L
- Availability (VA): N
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: P