CVE-2016-1000111

Published: Mar 11, 2020Modified: Nov 25, 2024

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

Affected (1)

Products: Twisted: Twisted

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Twisted Twisted	Before 16.3.1

Related CWEs

Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

References (8)

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

Source: cve@mitre.org

Third Party Advisory

https://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.html

Source: cve@mitre.org

Mailing ListVendor Advisory

https://twistedmatrix.com/trac/ticket/8623

Source: cve@mitre.org

PatchVendor Advisory

https://www.openwall.com/lists/oss-security/2016/07/18/6

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

https://twistedmatrix.com/trac/ticket/8623

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://www.openwall.com/lists/oss-security/2016/07/18/6

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.