CVE-2016-1000111

Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html	Third Party Advisory
https://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.html	Mailing List Vendor Advisory
https://twistedmatrix.com/trac/ticket/8623	Patch Vendor Advisory
https://www.openwall.com/lists/oss-security/2016/07/18/6	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:twistedmatrix:twisted:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-03-11 20:15

Updated : 2024-02-04 20:39

NVD link : CVE-2016-1000111

Mitre link : CVE-2016-1000111

CVE.ORG link : CVE-2016-1000111

JSON object : View

Products Affected

twistedmatrix

twisted

CWE

CWE-425

Direct Request ('Forced Browsing')

{"id": "CVE-2016-1000111", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2020-03-11T20:15:11.960", "references": [{"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.html", "tags": ["Mailing List", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://twistedmatrix.com/trac/ticket/8623", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.openwall.com/lists/oss-security/2016/07/18/6", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-425"}]}], "descriptions": [{"lang": "en", "value": "Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue."}, {"lang": "es", "value": "Twisted versiones anteriores a la versi\u00f3n 16.3.1, no intenta abordar los conflictos de espacio de nombres RFC 3875 secci\u00f3n 4.1.18 y, por lo tanto, no protege las aplicaciones CGI de la presencia de datos de clientes no seguros en la variable de entorno HTTP_PROXY, lo que podr\u00eda permitir a atacantes remotos redireccionar un tr\u00e1fico HTTP saliente de una aplicaci\u00f3n CGI hacia un servidor proxy arbitrario por medio de un encabezado Proxy especialmente dise\u00f1ado en una petici\u00f3n HTTP, tambi\u00e9n se conoce como un problema \"httpoxy\"."}], "lastModified": "2020-03-13T20:04:35.520", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:twistedmatrix:twisted:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EAB1F53F-5C2A-485E-9F3E-4F055D23B816", "versionEndExcluding": "16.3.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}