CVE-2024-5193

Ritlabs TinyWeb Server Request crlf injection

State: Published
Severity: 6.9 Medium
Published: May 22, 2024
Updated: Jan 5, 2026
Reserved: May 22, 2024

Description

A security vulnerability has been detected in Ritlabs TinyWeb Server 1.94. This vulnerability affects unknown code of the component Request Handler. The manipulation with the input %0D%0A leads to crlf injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.99 is able to resolve this issue. The identifier of the patch is d49c3da6a97e950975b18626878f3ee1f082358e. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
3.0	5.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-93 CRLF Injection
CWE-74 Injection

Affected Products

Product	Versions
TinyWeb ServerRitlabs	1.94Affected 1.99Not affected

References

VDB-265830 | Ritlabs TinyWeb Server Request crlf injectionvdb-entrytechnical-descriptionmitigationpatch
VDB-265830 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #333059 | Ritlabs TinyWeb Server 1.94 CRLF Injectionthird-party-advisory
https://github.com/DMCERTCE/CRLF_Tinyexploit
https://github.com/maximmasiutin/TinyWeb/commit/d49c3da6a97e950975b18626878f3ee1f082358epatch
https://github.com/maximmasiutin/TinyWeb/releases/tag/v1.99patch
https://www.masiutin.net/tinyweb-cve-2024-5193.htmlmitigation

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.