A header injection allows a attacker to insert arbitrary HTTP-Headers into the server’s response. This enables a attacker to change cookie values, add additional headers or in the case of a normal page to insert arbitrary code that gets executed as soon as the client receives the server’s response.

 As a workaround, we suggest using a Application firewall to block access to those urls externally.