CVE

Id
93636  
CVE No.
CVE-2016-6816  
Status
Candidate  
Description
The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.  
Phase
Assigned (20160812)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
794176 93636 CVE-2016-6816 CONFIRM:https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48  View
794177 93636 CVE-2016-6816 CONFIRM:https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73  View
794178 93636 CVE-2016-6816 CONFIRM:https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39  View
794179 93636 CVE-2016-6816 CONFIRM:https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8  View
794180 93636 CVE-2016-6816 CONFIRM:https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.0.M13  View
794181 93636 CVE-2016-6816 BID:94461  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
3851 JVNDB-2016-004624 PHP の ext/wddx/wddx.c の php_wddx_process_data 関数におけるサービス運用妨害 (DoS) の脆弱性 PHP の ext/wddx/wddx.c の php_wddx_process_data 関数には、サービス運用妨害 (セグメンテーション違反) 状態にされるなど、不特定の影響を受ける脆弱性が存在します。 CVE-2016-7129 93636 7.5 9.8 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004624.html  View