CVE-2023-34472: medium-severity vulnerability in AMI MegaRAC_SPx
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
AMI SPx BMC contains a flaw that allows attackers to inject carriage return and line feed characters into HTTP headers, potentially allowing them to manipulate responses or inject malicious content that users will trust.
CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers) allows an unauthenticated or low-privileged attacker to inject CRLF characters into HTTP response headers via the BMC interface, potentially enabling HTTP response splitting attacks. The vulnerability impacts integrity of HTTP communications and may allow header injection or cache poisoning depending on downstream processing.
In the same product, most dangerous first.