CVE-2008-4283 describes a critical CRLF injection vulnerability within the WebContainer component of IBM WebSphere Application Server (WAS) versions 5.1.1.19 and earlier 5.1.x. This flaw allows remote attackers to inject arbitrary HTTP headers, enabling HTTP response splitting attacks through unspecified vectors. The vulnerability carries a maximum CVSS score of 10.0, indicating a severe risk with a network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. Despite its high severity, its EPSS score is very low, suggesting a minimal probability of exploitation in the wild. Currently, there is no public exploit code available in Metasploit, Nuclei, or ExploitDB, and it is not listed on the CISA KEV catalog. Community discussion and media coverage for this CVE are also absent, indicating a lack of active exploitation or widespread attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 5.1.1.19CPE matchmatch criteria | cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:* | ||
5.0CPE matchmatch criteria | cpe:2.3:a:ibm:websphere_application_server:5.0:*:*:*:*:*:*:* | ||
5.0CPE matchmatch criteria | cpe:2.3:a:ibm:websphere_application_server:5.0:*:z_os:*:*:*:*:* | ||
5.0.0CPE matchmatch criteria | cpe:2.3:a:ibm:websphere_application_server:5.0.0:*:*:*:*:*:*:* | ||
5.0.1CPE matchmatch criteria | cpe:2.3:a:ibm:websphere_application_server:5.0.1:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.