PT-2016-5395 · Php+1 · Php+1

Pere Orga · Publicado 2016-04-12 · Atualizado 2022-05-17 · CVE-2016-3166

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x before 6.38

Description A CRLF injection issue exists in the drupal set header function when used with PHP before 5.1.2, allowing remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP headers.

Recommendations For Drupal versions 6.x before 6.38, update to version 6.38 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-113

Identificadores relacionados

CVE-2016-3166

GHSA-FG5Q-R2Q5-QMH3

Produtos afetados

Drupal

Php

Referências · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3166.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3166.yaml · Exploit
• https://github.com/drupal/core · Nota
• http://debian.org/security/2016/dsa-3498 · Aviso do Fabricante
• https://drupal.org/SA-CORE-2016-001 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-3166 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-3166 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-fg5q-r2q5-qmh3 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/03/15/10 · Nota
• http://openwall.com/lists/oss-security/2016/02/24/19 · Nota