CVE-2016-5385 (CNNVD-201607-538)
HIGH
中文标题:
PHP 输入验证错误漏洞
英文标题:
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and theref...
CVSS分数:
8.1
发布时间:
2016-07-19 01:00:00
漏洞类型:
输入验证错误
状态:
PUBLISHED
数据质量分数:
0.30
数据版本:
v3
漏洞描述
中文描述:
PHP是一种在服务器端执行的脚本语言。 PHP 7.0.8版本及之前版本中存在输入验证错误漏洞。攻击者利用该漏洞通过HTTP请求中特制的Proxy标头将应用程序的出站HTTP流量重定向到任意代理服务器。
英文描述:
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
CWE类型:
CWE-601
标签:
（暂无数据）
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| oracle | communications_user_data_repository | 10.0.0 | - | - |
cpe:2.3:a:oracle:communications_user_data_repository:10.0.0:*:*:*:*:*:*:*
|
| oracle | communications_user_data_repository | 10.0.1 | - | - |
cpe:2.3:a:oracle:communications_user_data_repository:10.0.1:*:*:*:*:*:*:*
|
| oracle | communications_user_data_repository | 12.0.0 | - | - |
cpe:2.3:a:oracle:communications_user_data_repository:12.0.0:*:*:*:*:*:*:*
|
| oracle | enterprise_manager_ops_center | 12.2.2 | - | - |
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:*
|
| oracle | enterprise_manager_ops_center | 12.3.2 | - | - |
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.2:*:*:*:*:*:*:*
|
| oracle | linux | 6 | - | - |
cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*
|
| oracle | linux | 7 | - | - |
cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*
|
| fedoraproject | fedora | 23 | - | - |
cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
|
| fedoraproject | fedora | 24 | - | - |
cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
|
| hp | storeever_msl6480_tape_library_firmware | * | - | - |
cpe:2.3:o:hp:storeever_msl6480_tape_library_firmware:*:*:*:*:*:*:*:*
|
| hp | system_management_homepage | * | - | - |
cpe:2.3:a:hp:system_management_homepage:*:*:*:*:*:*:*:*
|
| php | php | * | - | - |
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
|
| redhat | enterprise_linux_desktop | 6.0 | - | - |
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
|
| redhat | enterprise_linux_server | 6.0 | - | - |
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
|
| redhat | enterprise_linux_workstation | 6.0 | - | - |
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
|
| debian | debian_linux | 8.0 | - | - |
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
|
| opensuse | leap | 42.1 | - | - |
cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
|
| drupal | drupal | * | - | - |
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
FEDORA-2016-8eb11666aa
vendor-advisory
cve.org
访问
cve.org
无标题
x_refsource_CONFIRM
cve.org
访问
cve.org
无标题
x_refsource_CONFIRM
cve.org
访问
cve.org
VU#797896
third-party-advisory
cve.org
访问
cve.org
无标题
x_refsource_CONFIRM
cve.org
访问
cve.org
GLSA-201611-22
vendor-advisory
cve.org
访问
cve.org
openSUSE-SU-2016:1922
vendor-advisory
cve.org
访问
cve.org
无标题
x_refsource_CONFIRM
cve.org
访问
cve.org
无标题
x_refsource_CONFIRM
cve.org
访问
cve.org
RHSA-2016:1613
vendor-advisory
cve.org
访问
cve.org
RHSA-2016:1611
vendor-advisory
cve.org
访问
cve.org
RHSA-2016:1610
vendor-advisory
cve.org
访问
cve.org
DSA-3631
vendor-advisory
cve.org
访问
cve.org
91821
vdb-entry
cve.org
访问
cve.org
无标题
x_refsource_CONFIRM
cve.org
访问
cve.org
无标题
x_refsource_CONFIRM
cve.org
访问
cve.org
FEDORA-2016-4e7db3d437
vendor-advisory
cve.org
访问
cve.org
RHSA-2016:1609
vendor-advisory
cve.org
访问
cve.org
1036335
vdb-entry
cve.org
访问
cve.org
无标题
x_refsource_MISC
cve.org
访问
cve.org
无标题
x_refsource_CONFIRM
cve.org
访问
cve.org
RHSA-2016:1612
vendor-advisory
cve.org
访问
cve.org
无标题
x_refsource_CONFIRM
cve.org
访问
cve.org
FEDORA-2016-9c8cf5912c
vendor-advisory
cve.org
访问
cve.org
无标题
x_refsource_CONFIRM
cve.org
访问
cve.org
CVSS评分详情
8.1
HIGH
CVSS向量:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS版本:
3.1
机密性
HIGH
完整性
HIGH
可用性
HIGH
时间信息
发布时间:
2016-07-19 01:00:00
修改时间:
2024-08-06 01:00:59
创建时间:
2025-11-11 15:34:21
更新时间:
2025-11-11 15:52:34
利用信息
暂无可利用代码信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2016-5385 |
2025-11-11 15:19:09 | 2025-11-11 07:34:21 |
| NVD | nvd_CVE-2016-5385 |
2025-11-11 14:55:08 | 2025-11-11 07:43:01 |
| CNNVD | cnnvd_CNNVD-201607-538 |
2025-11-11 15:09:41 | 2025-11-11 07:52:34 |
版本与语言
当前版本:
v3
主要语言:
EN
支持语言:
EN
ZH
安全公告
暂无安全公告信息
变更历史
v3
CNNVD
2025-11-11 15:52:34
vulnerability_type: 未提取 → 输入验证错误; cnnvd_id: 未提取 → CNNVD-201607-538; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
- vulnerability_type: 未提取 -> 输入验证错误
- cnnvd_id: 未提取 -> CNNVD-201607-538
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2
NVD
2025-11-11 15:43:01
severity: SeverityLevel.MEDIUM → SeverityLevel.HIGH; cvss_score: 未提取 → 8.1; cvss_vector: NOT_EXTRACTED → CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H; cvss_version: NOT_EXTRACTED → 3.1; affected_products_count: 0 → 18; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
- severity: SeverityLevel.MEDIUM -> SeverityLevel.HIGH
- cvss_score: 未提取 -> 8.1
- cvss_vector: NOT_EXTRACTED -> CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- cvss_version: NOT_EXTRACTED -> 3.1
- affected_products_count: 0 -> 18
- data_sources: ['cve'] -> ['cve', 'nvd']