CVE-2016-1000109

Katalog CVE

CVSS 5.3 · Medium EPSS 5,1%

Kerentanan Improper Initialization pada facebook hhvm. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. This issue affects HHVM versions prior to 3.9.6, all versions between 3.10.0 and 3.12.4 (inclusive), and all versions between 3.13.0 and 3.14.2 (inclusive).

Rincian

Terbit di NVD

19 Februari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-665: Improper Initialization

EPSS (30 hari)

5,1% peluang dieksploitasi; lebih tinggi dari 92,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/facebook/hhvm/commit/423b4b719afd5ef4e6e19d8447fbf7b6bc0d0a25 patch · advisory pihak ketiga
• https://httpoxy.org/ exploit · mitigasi · advisory pihak ketiga
• https://www.facebook.com/security/advisories/cve-2016-1000109 advisory pihak ketiga