CVE-2023-4767

Summary

CVE-2023-4767 is a newly identified vulnerability affecting ManageEngine Desktop Central version 9.1.0. This issue involves a CRLF injection flaw in the software, which can be exploited by remote attackers. By manipulating the fileName parameter in the URL '/STATE_ID/1613157927228/InvSWMetering.csv', attackers can inject arbitrary HTTP headers and perform HTTP response splitting attacks, potentially leading to unintended server responses or data disclosure. This vulnerability poses a significant risk to organizations using the affected version of ManageEngine Desktop Central and requires immediate attention and patching.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.