{"api_version":"1","generated_at":"2026-07-23T06:03:00+00:00","cve":"CVE-2005-1087","urls":{"html":"https://cve.report/CVE-2005-1087","api":"https://cve.report/api/cve/CVE-2005-1087.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2005-1087","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2005-1087"},"summary":{"title":"CVE-2005-1087","description":"CRLF injection vulnerability in the cmdIS.DLL plugin for AN HTTPD Server 1.42n allows remote attackers to spoof or hide entries in the logfile, and possibly read files using an injected type command, via CRLF sequences in an HTTP request.","state":"PUBLISHED","assigner":"mitre","published_at":"2005-04-07 04:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.4","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:N","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/20031","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/20031","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1013666","name":"http://securitytracker.com/id?1013666","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"SecurityTracker.com Archives - AN HTTP Server 'cmdIS.DLL' Buffer Overflow Lets Local Users Execute Arbitrary Code and Remote Users Conduct Cross-Site Scripting Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.security.org.sg/vuln/anhttpd142n.html","name":"http://www.security.org.sg/vuln/anhttpd142n.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"SIG^2 G-TEC - AN HTTPD Server cmdIS.DLL Buffer Overflow and LogFile Arbitrary Character Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/15362","name":"http://www.osvdb.org/15362","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://secunia.com/advisories/14861","name":"http://secunia.com/advisories/14861","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Secunia - Advisories - AN HTTPD cmdIS.DLL Buffer Overflow and Log File Injection","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-1087","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-1087","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2005","cve_id":"1087","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"an","cpe5":"an-httpd","cpe6":"1.42n","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T21:35:59.851Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"15362","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/15362"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.security.org.sg/vuln/anhttpd142n.html"},{"name":"14861","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/14861"},{"name":"an-httpd-logfile-character-injection(20031)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/20031"},{"name":"1013666","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1013666"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2005-04-07T00:00:00.000Z","descriptions":[{"lang":"en","value":"CRLF injection vulnerability in the cmdIS.DLL plugin for AN HTTPD Server 1.42n allows remote attackers to spoof or hide entries in the logfile, and possibly read files using an injected type command, via CRLF sequences in an HTTP request."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-10T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"15362","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/15362"},{"tags":["x_refsource_MISC"],"url":"http://www.security.org.sg/vuln/anhttpd142n.html"},{"name":"14861","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/14861"},{"name":"an-httpd-logfile-character-injection(20031)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/20031"},{"name":"1013666","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1013666"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2005-1087","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"CRLF injection vulnerability in the cmdIS.DLL plugin for AN HTTPD Server 1.42n allows remote attackers to spoof or hide entries in the logfile, and possibly read files using an injected type command, via CRLF sequences in an HTTP request."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"15362","refsource":"OSVDB","url":"http://www.osvdb.org/15362"},{"name":"http://www.security.org.sg/vuln/anhttpd142n.html","refsource":"MISC","url":"http://www.security.org.sg/vuln/anhttpd142n.html"},{"name":"14861","refsource":"SECUNIA","url":"http://secunia.com/advisories/14861"},{"name":"an-httpd-logfile-character-injection(20031)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/20031"},{"name":"1013666","refsource":"SECTRACK","url":"http://securitytracker.com/id?1013666"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2005-1087","datePublished":"2005-04-13T04:00:00.000Z","dateReserved":"2005-04-13T00:00:00.000Z","dateUpdated":"2024-08-07T21:35:59.851Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2005-04-07 04:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:N","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:an:an-httpd:1.42n:*:*:*:*:*:*:*","matchCriteriaId":"E925BE54-5384-479A-BC60-DEEFF4C7093F"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2005","CveId":"1087","Ordinal":"1","Title":"CVE-2005-1087","CVE":"CVE-2005-1087","Year":"2005"},"notes":[{"CveYear":"2005","CveId":"1087","Ordinal":"1","NoteData":"CRLF injection vulnerability in the cmdIS.DLL plugin for AN HTTPD Server 1.42n allows remote attackers to spoof or hide entries in the logfile, and possibly read files using an injected type command, via CRLF sequences in an HTTP request.","Type":"Description","Title":"CVE-2005-1087"},{"CveYear":"2005","CveId":"1087","Ordinal":"2","NoteData":"2005-04-13","Type":"Other","Title":"Published"},{"CveYear":"2005","CveId":"1087","Ordinal":"3","NoteData":"2017-07-10","Type":"Other","Title":"Modified"}]}}}