Read the docs
TI-2012-03443 Aliases CVE-2012-4023GHSA-mg76-63w4-x6ch

CRLF injection vulnerability in Pebble before 2.6.4 allows remote attackers to inject…

Priority LOW 22CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

CRLF injection vulnerability in Pebble before 2.6.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Why it matters now

EPSS 0.01168 67th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 48

CPEVersionsRoleVendor
cpe:2.3:a:simon_brown:pebble:*:*:*:*:*:*:*:*up to 2.6.3VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.0:*:*:*:*:*:*:*1.0VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.1:*:*:*:*:*:*:*1.1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.2:*:*:*:*:*:*:*1.2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.3:*:*:*:*:*:*:*1.3VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.4:*:*:*:*:*:*:*1.4VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.4:beta1:*:*:*:*:*:*1.4 beta1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.4:beta2:*:*:*:*:*:*1.4 beta2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.4:beta3:*:*:*:*:*:*1.4 beta3VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.4.1:*:*:*:*:*:*:*1.4.1VulnerableSimon Brown
  • cpe:2.3:a:simon_brown:pebble:*:*:*:*:*:*:*:* Versions up to 2.6.3 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.4:*:*:*:*:*:*:* Versions 1.4 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.4:beta1:*:*:*:*:*:* Versions 1.4 beta1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.4:beta2:*:*:*:*:*:* Versions 1.4 beta2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.4:beta3:*:*:*:*:*:* Versions 1.4 beta3 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·Simon Brown
Show 38 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:simon_brown:pebble:1.4.2:*:*:*:*:*:*:*1.4.2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.5:*:*:*:*:*:*:*1.5VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.5:beta1:*:*:*:*:*:*1.5 beta1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.5:beta2:*:*:*:*:*:*1.5 beta2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.5.1:*:*:*:*:*:*:*1.5.1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.6:beta3:*:*:*:*:*:*1.6 beta3VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.7:*:*:*:*:*:*:*1.7VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.7:beta1:*:*:*:*:*:*1.7 beta1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.7.1:*:*:*:*:*:*:*1.7.1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.7.2:*:*:*:*:*:*:*1.7.2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.8:*:*:*:*:*:*:*1.8VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:1.9:*:*:*:*:*:*:*1.9VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.0:*:*:*:*:*:*:*2.0VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.0.0:m1:*:*:*:*:*:*2.0.0 m1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.0.0:m2:*:*:*:*:*:*2.0.0 m2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.0.0:m3:*:*:*:*:*:*2.0.0 m3VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.0.0:rc1:*:*:*:*:*:*2.0.0 rc1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.0.0:rc2:*:*:*:*:*:*2.0.0 rc2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.1:*:*:*:*:*:*:*2.1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.1:rc1:*:*:*:*:*:*2.1 rc1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.2:*:*:*:*:*:*:*2.2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.3:*:*:*:*:*:*:*2.3VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.3.1:*:*:*:*:*:*:*2.3.1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.3.2:*:*:*:*:*:*:*2.3.2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.4:*:*:*:*:*:*:*2.4VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.4:rc2:*:*:*:*:*:*2.4 rc2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.5:*:*:*:*:*:*:*2.5VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.5:m1:*:*:*:*:*:*2.5 m1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.5:m2:*:*:*:*:*:*2.5 m2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.5:rc1:*:*:*:*:*:*2.5 rc1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.5.1:*:*:*:*:*:*:*2.5.1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.5.2:*:*:*:*:*:*:*2.5.2VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.5.3:*:*:*:*:*:*:*2.5.3VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.6:*:*:*:*:*:*:*2.6VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.6:m1:*:*:*:*:*:*2.6 m1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.6.1:*:*:*:*:*:*:*2.6.1VulnerableSimon Brown
cpe:2.3:a:simon_brown:pebble:2.6.2:*:*:*:*:*:*:*2.6.2VulnerableSimon Brown
  • cpe:2.3:a:simon_brown:pebble:1.4.2:*:*:*:*:*:*:* Versions 1.4.2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.5:beta1:*:*:*:*:*:* Versions 1.5 beta1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.5:beta2:*:*:*:*:*:* Versions 1.5 beta2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.6:beta3:*:*:*:*:*:* Versions 1.6 beta3 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.7:*:*:*:*:*:*:* Versions 1.7 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.7:beta1:*:*:*:*:*:* Versions 1.7 beta1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.7.1:*:*:*:*:*:*:* Versions 1.7.1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.7.2:*:*:*:*:*:*:* Versions 1.7.2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.8:*:*:*:*:*:*:* Versions 1.8 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:1.9:*:*:*:*:*:*:* Versions 1.9 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.0.0:m1:*:*:*:*:*:* Versions 2.0.0 m1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.0.0:m2:*:*:*:*:*:* Versions 2.0.0 m2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.0.0:m3:*:*:*:*:*:* Versions 2.0.0 m3 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.0.0:rc2:*:*:*:*:*:* Versions 2.0.0 rc2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.1:rc1:*:*:*:*:*:* Versions 2.1 rc1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.3.2:*:*:*:*:*:*:* Versions 2.3.2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.4:*:*:*:*:*:*:* Versions 2.4 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.4:rc2:*:*:*:*:*:* Versions 2.4 rc2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.5:m1:*:*:*:*:*:* Versions 2.5 m1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.5:m2:*:*:*:*:*:* Versions 2.5 m2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.5:rc1:*:*:*:*:*:* Versions 2.5 rc1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.5.1:*:*:*:*:*:*:* Versions 2.5.1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.5.2:*:*:*:*:*:*:* Versions 2.5.2 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.5.3:*:*:*:*:*:*:* Versions 2.5.3 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.6:*:*:*:*:*:*:* Versions 2.6 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.6:m1:*:*:*:*:*:* Versions 2.6 m1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·Simon Brown
  • cpe:2.3:a:simon_brown:pebble:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Simon Brown

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-4023
  2. 2026-10-03 Alias added: GHSA-mg76-63w4-x6ch

References

Advisory 2

  • TI-2012-03442 Pebble before 2.6.4 allows remote attackers to trigger loss of blog-entry viewability via a crafted comment. CVSS 2.0MEDIUM 6.4
  • TI-2012-04359 Open redirect vulnerability in Pebble before 2.6.4 allows remote attackers to redirect… CVSS 2.0MEDIUM 5.8
  • TI-2009-00701 Cross-site scripting (XSS) vulnerability in Pebble before 2.3.2 allows remote attackers… CVSS 2.0MEDIUM 4.3
  • TI-2006-04984 Cross-site scripting (XSS) vulnerability in the search functionality in Simon Brown… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences