NVD

Id
20658  
Name
CVE-2016-5388  
Description
Apache Tomcat through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application"s outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.  
Reject
 
CVSS Version
2  
CVSS Score
5.1  
Severity
Medium  
CVSS Base Score
5.1  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-07-18  
Modified Date
2016-11-28  
Seq
2016-5388  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
113085 20658 CVE-2016-5388 openSUSE-SU-2016:2252  View
113086 20658 CVE-2016-5388 RHSA-2016:1624  View
113087 20658 CVE-2016-5388 RHSA-2016:2045  View
113088 20658 CVE-2016-5388 RHSA-2016:2046  View
113089 20658 CVE-2016-5388 VU#797896  View
113090 20658 CVE-2016-5388 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html  View
113091 20658 CVE-2016-5388 91818  View
113092 20658 CVE-2016-5388 1036331  View
113093 20658 CVE-2016-5388 RHSA-2016:1635  View
113094 20658 CVE-2016-5388 RHSA-2016:1636  View
113095 20658 CVE-2016-5388 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149  View
113096 20658 CVE-2016-5388 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759  View
113097 20658 CVE-2016-5388 https://httpoxy.org/  View
113098 20658 CVE-2016-5388 https://www.apache.org/security/asf-httpoxy-response.txt  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
3030 JVNDB-2016-003803 Apache Tomcat における任意のプロキシサーバにアプリケーションのアウトバウンド HTTP トラフィックをリダイレクトされる脆弱性 Apache Tomcat は、CGI サーブレットが有効になっている場合、 RFC 3875 セクション 4.1.18 に準拠する結果、 HTTP_PROXY 環境変数の信頼できないクライアントデータの存在からアプリケーションを保護しないため、任意のプロキシサーバにアプリケーションのアウトバウンド HTTP トラフィックをリダイレクトされる脆弱性が存在します。 CVE-2016-5388 91894 CVE-2016-5388 20658 5.1 8.1 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-003803.html 2016-07-18 2016-12-06 View