CVE-2013-2652: CRLF injection vulnerability in help/help_language.php in WebCollab 3.30 and earlier allows remote attacker...

Security readout for executives and security teams

WebCollab 3.30 and earlier had a flaw in a help page parameter that could let a remote attacker make the server send attacker-controlled HTTP headers. For leaders, the risk is web trust boundary abuse: users or intermediaries may receive misleading responses. No source in the bundle shows active exploitation. Exposure is likely limited to internet- or intranet-facing WebCollab deployments running 3.30 or earlier. Organizations without WebCollab, or with a version later than 3.30, are not shown affected by the provided sources. Treat as a targeted legacy web-application cleanup item. Prioritize if WebCollab is internet-facing or used in sensitive workflows, but current evidence does not support emergency exploitation response. Mitigation focus: Inventory WebCollab installations and identify any version 3.30 or earlier.; Upgrade affected deployments to a vendor-supported release; review the WebCollab 3.31 announcement.; Restrict access to WebCollab if immediate upgrade is not possible..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.