← Vulnerability feed

Vulnerability record · CVE-2002-1405 · published 19 February 2003

CVE-2002-1405: Elinks vulnerability

EElinks · Elinks

CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on the command line, via a URL containing encoded carriage return, line feed, and other whitespace characters.

5.0 CVSS 2.0 Medium EPSS 5.0% · top 8.0%
5.0CVSS 2.0 base score
5.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
20References
16 Jun 2026Last modified by NVD

Description

CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on the command line, via a URL containing encoded carriage return, line feed, and other whitespace characters.

AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-049.0.txt
http://marc.info/?l=bugtraq&m=102978118411977&w=2
http://marc.info/?l=bugtraq&m=103003793418021&w=2
http://www.debian.org/security/2002/dsa-210 PatchVendor Advisory
http://www.iss.net/security_center/static/9887.php PatchVendor Advisory
http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:023
http://www.redhat.com/support/errata/RHSA-2003-029.html
http://www.redhat.com/support/errata/RHSA-2003-030.html
http://www.securityfocus.com/bid/5499
http://www.trustix.net/errata/misc/2002/TSL-2002-0085-lynx-ssl.asc.txt
ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-049.0.txt
http://marc.info/?l=bugtraq&m=102978118411977&w=2
http://marc.info/?l=bugtraq&m=103003793418021&w=2
http://www.debian.org/security/2002/dsa-210 PatchVendor Advisory
http://www.iss.net/security_center/static/9887.php PatchVendor Advisory
http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:023
http://www.redhat.com/support/errata/RHSA-2003-029.html
http://www.redhat.com/support/errata/RHSA-2003-030.html
http://www.securityfocus.com/bid/5499
http://www.trustix.net/errata/misc/2002/TSL-2002-0085-lynx-ssl.asc.txt

Track CVE-2002-1405 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-1999-0817University of kansas lynx vulnerabilityLynx WWW client allows a remote attacker to specify command-line parameters which Lynx uses when calling external programs to handle certain protocol…EPSS 3.1%7.8CVE-2008-7224Elinks memory buffer overflow vulnerabilityBuffer overflow in entity_cache in ELinks before 0.11.4rc0 allows remote attackers to cause a denial of service (crash) via a crafted link.EPSS 2.8%7.6CVE-2000-0209University of kansas lynx vulnerabilityBuffer overflow in Lynx 2.x allows remote attackers to crash Lynx and possibly execute commands via a long URL in a malicious web page.EPSS 2.1%7.5CVE-2006-5925Elinks vulnerabilityLinks web browser 1.00pre12 and Elinks 0.9.2 with smbclient installed allows remote attackers to execute arbitrary code via shell metacharacters in a…EPSS 8.3%7.5CVE-2005-2929University of kansas lynx permissions and access controls vulnerabilityLynx 2.8.5, and other versions before 2.8.6dev.15, allows remote attackers to execute arbitrary commands via (1) lynxcgi:, (2) lynxexec, and (3) lynx…EPSS 4.9%5.9CVE-2012-6709Elinks improper certificate validation vulnerabilityELinks 0.12 and Twibright Links 2.3 have Missing SSL Certificate Validation.EPSS 0.57%5.1CVE-2012-4545Elinks improper authentication vulnerabilityThe http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GSS-Negotia…EPSS 1.9%5.0CVE-2004-1616Links vulnerabilityLinks allows remote attackers to cause a denial of service (memory consumption) via a web page or HTML email that contains a table with a td element …EPSS 1.9%

Source: NIST National Vulnerability Database (record CVE-2002-1405), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.