CVE-2024-45597 - CVE House
Back to Database
Status published Medium CVE-2024-45597

Pluto's http.request allows CR and LF in header values

Vulnerability Description

Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header values are affected. An attacker could use this to send arbitrary requests, potentially leveraging authentication tokens provided in the same headers table.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-45597

Credits & Attribution

No credits recorded in the NVD database.

References

More from PlutoLang

View All →
CVE-2024-32973
Remote for TLS session may be trusted despite constraints in Pluto lang
Medium 4.8

Affected Vendor

Affected Software

Pluto
Vulnerable Versions:
>= 0.9.0, <= 0.9.4

Timeline

Official Publish: September 10th, 2024
Last Modified: September 11th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-93

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.