PT-2016-5395 · Php+1 · Php+1

Pere Orga · Published 2016-04-12 · Updated 2022-05-17 · CVE-2016-3166

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x before 6.38

Description A CRLF injection issue exists in the drupal set header function when used with PHP before 5.1.2, allowing remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP headers.

Recommendations For Drupal versions 6.x before 6.38, update to version 6.38 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-113

Related Identifiers

CVE-2016-3166

GHSA-FG5Q-R2Q5-QMH3

Affected Products

Drupal

Php

References · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3166.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3166.yaml · Exploit
• http://debian.org/security/2016/dsa-3498 · Vendor Advisory
• https://drupal.org/SA-CORE-2016-001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-3166 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3166 · Security Note
• https://osv.dev/vulnerability/GHSA-fg5q-r2q5-qmh3 · Vendor Advisory
• https://github.com/drupal/core · Note
• http://openwall.com/lists/oss-security/2016/03/15/10 · Note
• http://openwall.com/lists/oss-security/2016/02/24/19 · Note