Attacker Value
Unknown
CVE-2016-5387
CVE-2016-5387
(Last updated November 08, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application’s outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an “httpoxy” issue. NOTE: the vendor states “This mitigation has been assigned the identifier CVE-2016-5387”; in other words, this is not a CVE ID for a vulnerability.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
8.1 High
Impact Score:
5.9
Exploitability Score:
2.2
Attack Vector (AV):
Network
Attack Complexity (AC):
High
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High
General Information
Vendors
- apache,
- canonical,
- debian,
- fedoraproject,
- hp,
- opensuse,
- oracle,
- redhat
Products
- communications user data repository,
- debian linux 8.0,
- enterprise linux desktop 6.0,
- enterprise linux desktop 7.0,
- enterprise linux eus 7.2,
- enterprise linux eus 7.3,
- enterprise linux eus 7.4,
- enterprise linux eus 7.5,
- enterprise linux eus 7.6,
- enterprise linux eus 7.7,
- enterprise linux server 6.0,
- enterprise linux server 7.0,
- enterprise linux server aus 7.2,
- enterprise linux server aus 7.3,
- enterprise linux server aus 7.4,
- enterprise linux server aus 7.6,
- enterprise linux server aus 7.7,
- enterprise linux server tus 7.2,
- enterprise linux server tus 7.3,
- enterprise linux server tus 7.6,
- enterprise linux server tus 7.7,
- enterprise linux workstation 6.0,
- enterprise linux workstation 7.0,
- enterprise manager ops center 12.2.2,
- enterprise manager ops center 12.3.2,
- fedora 23,
- fedora 24,
- http server,
- jboss core services 1.0,
- jboss enterprise web server 2.0.0,
- jboss enterprise web server 3.0.0,
- jboss web server 2.1.0,
- leap 42.1,
- linux 5,
- linux 6,
- linux 7,
- opensuse 13.2,
- solaris 11.3,
- system management homepage,
- ubuntu linux 12.04,
- ubuntu linux 14.04,
- ubuntu linux 15.10,
- ubuntu linux 16.04
References
Advisory
Miscellaneous
