Home > Vulnerability Database > CVE-2016-5388

Mend.io Vulnerability Database

CVE-2016-5388

Good to know:

Date: July 18, 2016

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.

Language: Java

Severity Score

8.1

Related Resources (30)

Url: http://rhn.redhat.com/errata/RHSA-2016-2046.html

Url: https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E

Url: http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2016-5388

Url: https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E

Url: https://access.redhat.com/security/cve/CVE-2016-5388

Url: https://tomcat.apache.org/tomcat-7.0-doc/changelog.html

Url: https://httpoxy.org/

Url: https://lists.apache.org/thread.html/rc6b2147532416cc736e68a32678d3947b7053c3085cf43a9874fd102%40%3Cusers.tomcat.apache.org%3E

Url: http://www.securitytracker.com/id/1036331

Url: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149

Url: https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html

Url: http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Url: http://rhn.redhat.com/errata/RHSA-2016-2045.html

Url: http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html

Url: http://www.kb.cert.org/vuls/id/797896

Url: https://lists.apache.org/thread.html/rf21b368769ae70de4dee840a3228721ae442f1d51ad8742003aefe39%40%3Cusers.tomcat.apache.org%3E

Url: https://security-tracker.debian.org/tracker/CVE-2016-5388

Url: https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3E

Url: https://www.apache.org/security/asf-httpoxy-response.txt

Url: https://lists.apache.org/thread.html/r2853582063cfd9e7fbae1e029ae004e6a83482ae9b70a698996353dd%40%3Cusers.tomcat.apache.org%3E

Url: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759

Url: https://access.redhat.com/errata/RHSA-2016:1635

Url: https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722

Url: https://access.redhat.com/errata/RHSA-2016:1636

Url: https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us

Url: http://rhn.redhat.com/errata/RHSA-2016-1624.html

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2016-5388

Url: http://www.securityfocus.com/bid/91818

Url: https://www.mend.io/vulnerability-database/CVE-2016-5388

Severity Score

8.1

Weakness Type (CWE)

Improper Access Control

CWE-284

Top Fix

Upgrade Version

Upgrade to version org.apache.tomcat.embed:tomcat-embed-core:8.5.5,7.0.72,org.apache.tomcat:tomcat-catalina:8.5.5,7.0.72

Learn More

CVSS v3.1

Base Score:	8.1
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

CVSS v2

Base Score:	5.1
Access Vector (AV):	NETWORK
Access Complexity (AC):	HIGH
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2016-5388

Good to know:

Date: July 18, 2016

Language: Java

Severity Score

Related Resources (30)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

CVSS v2

Do you need more information?