CVE catalog

CVE-2018-11652

nikto: CVE-2018-11652

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
23.64% · Oct 25, 2026

CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianniktosid1:2.1.5-3.1fixed
Debianniktoforky1:2.1.5-3.1fixed
Debianniktotrixie1:2.1.5-3.1fixed
Debianniktobookworm1:2.1.5-3.1fixed
Alpinenikto3.112.1.6-r2fixed
Alpinenikto3.122.1.6-r2fixed
Alpinenikto3.132.1.6-r2fixed
Alpinenikto3.142.1.6-r2fixed
Alpinenikto3.152.1.6-r2fixed
Alpinenikto3.162.1.6-r2fixed
Alpinenikto3.172.1.6-r2fixed
Alpinenikto3.182.1.6-r2fixed
Ubuntunikto16.041:2.1.5-1vulnerable
Ubuntunikto18.041:2.1.5-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianniktosourcesid1:2.1.5-3not yet assignedNot reported[900608]
Debianniktosourceforky1:2.1.5-3not yet assignedNot reported[900608]
Debianniktosourcetrixie1:2.1.5-3not yet assignedNot reported[900608]
Debianniktosourcebookworm1:2.1.5-3not yet assignedNot reported[900608]
Alpineniktoapk3.112.1.6-r2Not reportedALPINE-CVE-2018-11652Not reported
Alpineniktoapk3.122.1.6-r2Not reportedALPINE-CVE-2018-11652Not reported
Alpineniktoapk3.132.1.6-r2Not reportedALPINE-CVE-2018-11652Not reported
Alpineniktoapk3.142.1.6-r2Not reportedALPINE-CVE-2018-11652Not reported
Alpineniktoapk3.152.1.6-r2Not reportedALPINE-CVE-2018-11652Not reported
Alpineniktoapk3.162.1.6-r2Not reportedALPINE-CVE-2018-11652Not reported
Alpineniktoapk3.172.1.6-r2Not reportedALPINE-CVE-2018-11652Not reported
Alpineniktoapk3.182.1.6-r2Not reportedALPINE-CVE-2018-11652Not reported

[Debian bug #900608]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [nikto]Unknown
    Details (2)

    • 1:2.1.5-3.1 · all · bookworm

      Fixed · Fixed: 1:2.1.5-3

      dsa · nikto · debian · bookworm; dsa · nikto · debian · 12

    • 1:2.1.5-3.1 · all · bookworm

      Fixed · Fixed: 1:2.1.5-3

      dsa · nikto · debian · bookworm; dsa · nikto · debian · 12

[Debian 13 (Trixie)]

  • [nikto]Unknown
    Details (2)

    • 1:2.1.5-3.1 · all · trixie

      Fixed · Fixed: 1:2.1.5-3

      dsa · nikto · debian · 13

    • 1:2.1.5-3.1 · all · trixie

      Fixed · Fixed: 1:2.1.5-3

      dsa · nikto · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]