CRLF Injection flaw: Improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting')

Description

Description
A function call contains an HTTP response splitting flaw. Writing untrusted input into an HTTP header allows an attacker to manipulate the HTTP response rendered by the browser, leading to cache poisoning and cross-site scripting attacks.

Recommendations
Remove unexpected carriage returns and line feeds from untrusted data used to construct an HTTP response. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.

Offender:
episerver.marketing.connector.dll
void UpsertTrackingCookie(string, string, System.Collections.Generic.List<Connector.Framework.Data.CookieData>) 66%