U.S. General Services Administration · Report #1038594
CRLF INJECTION
Validstatus
lowseverity
32upvotes
10 Apr 2021disclosed
How it was found
Vulnerable url - https://www.epay.fas.gsa.gov/%0D%0ASet-Cookie:crlfinjection=crlfinjection
Impact
an attacker can set new header