Vulnerability Intelligence Report
CVE-2016-5387
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.
No Active Exploit Signals
CVSS Base Score
8.1
HIGH
EPSS Probability:55.72%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| apache | http_server | all |
| hp | system_management_homepage | all |
| oracle | communications_user_data_repository | all |
| oracle | enterprise_manager_ops_center | 12.2.2, 12.3.2 |
| oracle | linux | 5, 6, 7 |
| oracle | solaris | 11.3 |
| fedoraproject | fedora | 23, 24 |
| redhat | jboss_web_server | 2.1.0 |
| redhat | enterprise_linux | 6.0, 7.0 |
| redhat | jboss_enterprise_web_server | 2.0.0, 3.0.0 |
| redhat | jboss_core_services | 1.0 |
| redhat | enterprise_linux_desktop | 6.0, 7.0 |
| redhat | enterprise_linux_eus | 7.2, 7.3, 7.4, 7.5, 7.6, 7.7 |
| redhat | enterprise_linux_server | 6.0, 7.0 |
| redhat | enterprise_linux_server_aus | 7.2, 7.3, 7.4, 7.6, 7.7 |
| redhat | enterprise_linux_server_tus | 7.2, 7.3, 7.6, 7.7 |
| redhat | enterprise_linux_workstation | 6.0, 7.0 |
| debian | debian_linux | 8.0 |
| canonical | ubuntu_linux | 12.04, 14.04, 15.10, 16.04 |
| opensuse | leap | 42.1 |
| opensuse | opensuse | 13.2 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
55.724%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Red Hat, Inc. · Vendor · USA |
| Reserved | 2016-06-10T00:00:00 |
| Published | 2016-07-19T01:00:00 |
| Patch Date | 2016-07-18 |
| Last Updated | 2024-08-06T01:00:59 |
Community Chatter & Buzz