Direct naar de inhoud
⚡ Kritieke cyberalerts voor jouw sector & systemen — direct in je inbox. Aanmelden →
cybernieuws.nl Cybersecurity en informatiebeveiling nieuws alerts live · 2 min 164 bronnen 65 vandaag
CVE's Videos Dagbriefing

← Terug naar CVE-database

CVE-2016-5387

HIGH · 8.1 CVSS Gepubliceerd:

Beschrijving NL

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.

Origineel (Engels) tonen

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.

Vendors

Apache Hp Oracle Fedoraproject Redhat Debian Canonical Opensuse

Affected products

Http Server System Management Homepage Communications User Data Repository Enterprise Manager Ops Center Linux Solaris Fedora Jboss Web Server Enterprise Linux Jboss Enterprise Web Server Jboss Core Services Enterprise Linux Desktop Enterprise Linux Eus Enterprise Linux Server Enterprise Linux Server Aus Enterprise Linux Server Tus Enterprise Linux Workstation Debian Linux Ubuntu Linux Leap Opensuse

References