CVE-2024-5193

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-5193
A security vulnerability has been detected in Ritlabs TinyWeb Server 1.94. This vulnerability affects unknown code of the component Request Handler. The manipulation with the input %0D%0A leads to crlf injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.99 is able to resolve this issue. The identifier of the patch is d49c3da6a97e950975b18626878f3ee1f082358e. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure but did not respond in any way.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://github.com/DMCERTCE/CRLF_Tiny Exploit
https://github.com/maximmasiutin/TinyWeb/commit/d49c3da6a97e950975b18626878f3ee1f082358e
https://github.com/maximmasiutin/TinyWeb/releases/tag/v1.99
https://vuldb.com/?ctiid.265830 Permissions Required VDB Entry
https://vuldb.com/?id.265830 Third Party Advisory VDB Entry
https://vuldb.com/?submit.333059 Third Party Advisory VDB Entry
https://www.masiutin.net/tinyweb-cve-2024-5193.html
https://github.com/DMCERTCE/CRLF_Tiny Exploit
https://vuldb.com/?ctiid.265830 Permissions Required VDB Entry
https://vuldb.com/?id.265830 Third Party Advisory VDB Entry
https://vuldb.com/?submit.333059 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:ritlabs:tinyweb:1.94:*:*:*:*:*:*:*
History

05 Jan 2026, 19:15

Type Values Removed Values Added
Summary (en) A vulnerability was found in Ritlabs TinyWeb Server 1.94. It has been classified as problematic. Affected is an unknown function of the component Request Handler. The manipulation with the input %0D%0A leads to crlf injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-265830 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. (en) A security vulnerability has been detected in Ritlabs TinyWeb Server 1.94. This vulnerability affects unknown code of the component Request Handler. The manipulation with the input %0D%0A leads to crlf injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.99 is able to resolve this issue. The identifier of the patch is d49c3da6a97e950975b18626878f3ee1f082358e. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure but did not respond in any way.
CWE CWE-74
References
  • () https://github.com/maximmasiutin/TinyWeb/commit/d49c3da6a97e950975b18626878f3ee1f082358e -
  • () https://github.com/maximmasiutin/TinyWeb/releases/tag/v1.99 -
  • () https://www.masiutin.net/tinyweb-cve-2024-5193.html -

23 Jun 2025, 15:07

Type Values Removed Values Added
CPE cpe:2.3:a:ritlabs:tinyweb:1.94:*:*:*:*:*:*:*
References () https://github.com/DMCERTCE/CRLF_Tiny - () https://github.com/DMCERTCE/CRLF_Tiny - Exploit
References () https://vuldb.com/?ctiid.265830 - () https://vuldb.com/?ctiid.265830 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.265830 - () https://vuldb.com/?id.265830 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.333059 - () https://vuldb.com/?submit.333059 - Third Party Advisory, VDB Entry
First Time Ritlabs
Ritlabs tinyweb

21 Nov 2024, 09:47

Type Values Removed Values Added
References () https://github.com/DMCERTCE/CRLF_Tiny - () https://github.com/DMCERTCE/CRLF_Tiny -
References () https://vuldb.com/?ctiid.265830 - () https://vuldb.com/?ctiid.265830 -
References () https://vuldb.com/?id.265830 - () https://vuldb.com/?id.265830 -
References () https://vuldb.com/?submit.333059 - () https://vuldb.com/?submit.333059 -

04 Jun 2024, 19:21

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en Ritlabs TinyWeb Server 1.94. Ha sido clasificada como problemática. Una función desconocida del componente Request Handler es afectada por esta vulnerabilidad. La manipulación con la entrada %0D%0A conduce a la inyección crlf. Es posible lanzar el ataque de forma remota. El exploit ha sido divulgado al público y puede utilizarse. VDB-265830 es el identificador asignado a esta vulnerabilidad. NOTA: Se contactó primeramente con el proveedor sobre esta divulgación, pero no respondió de ninguna manera.

22 May 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-22 11:15

Updated : 2026-01-05 19:15

NVD link : CVE-2024-5193

Mitre link : CVE-2024-5193

CVE.ORG link : CVE-2024-5193

JSON object : View

Products Affected

ritlabs

  • tinyweb
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')