CVE-2016-10397

EPSS 0.4%
Veröffentlicht 10.07.2017 14:29:00
Zuletzt bearbeitet 20.04.2025 01:37:25
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as demonstrated by evil.example.com:80#@good.example.com/ and evil.example.com:80?@good.example.com/ inputs to the parse_url function (implemented in the php_url_parse_ex function in ext/standard/url.c).

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 10

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Php ≫ Php Version <= 5.6.27

Php ≫ Php Version7.0.0

Php ≫ Php Version7.0.1

Php ≫ Php Version7.0.2

Php ≫ Php Version7.0.3

Php ≫ Php Version7.0.4

Php ≫ Php Version7.0.5

Php ≫ Php Version7.0.6

Php ≫ Php Version7.0.7

Php ≫ Php Version7.0.8

Php ≫ Php Version7.0.9

Php ≫ Php Version7.0.10

Php ≫ Php Version7.0.11

Php ≫ Php Version7.0.12

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.4%	0.602

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:P/A:N

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://php.net/ChangeLog-5.php

Vendor Advisory

Release Notes

http://php.net/ChangeLog-7.php

Vendor Advisory

Release Notes

https://security.netapp.com/advisory/ntap-20180112-0001/

http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=b061fa909de77085d3822a89ab901b934d0362c4

http://openwall.com/lists/oss-security/2017/07/10/6

Patch

Third Party Advisory

Mailing List