Unrated severityNVD Advisory· Published Jan 10, 2008· Updated Apr 23, 2026

CVE-2008-0202

Description

CRLF injection vulnerability in index.php in ExpressionEngine 1.2.1 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the URL parameter.

Affected products

Expressionengine/Expressionengine
cpe:2.3:a:expressionengine:expressionengine:*:*:*:*:*:*:*:*
Range: <=1.2.1

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.htmlnvd
securityreason.com/securityalert/3539nvd
securityvulns.ru/Sdocument472.htmlnvd
websecurity.com.ua/1454/nvd
www.securityfocus.com/archive/1/485786/100/0/threadednvd
www.securityfocus.com/bid/27128nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000