CVE-2016-10397

EPSS 0.4%
Published 10.07.2017 14:29:00
Last modified 20.04.2025 01:37:25
Source cve@mitre.org
Teams watchlist Login
Open Login

In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as demonstrated by evil.example.com:80#@good.example.com/ and evil.example.com:80?@good.example.com/ inputs to the parse_url function (implemented in the php_url_parse_ex function in ext/standard/url.c).

Affected products Warnungen 0 Metrics 3 CWE 1 References 10

Data is provided by the National Vulnerability Database (NVD)

Php ≫ Php Version <= 5.6.27

Php ≫ Php Version7.0.0

Php ≫ Php Version7.0.1

Php ≫ Php Version7.0.2

Php ≫ Php Version7.0.3

Php ≫ Php Version7.0.4

Php ≫ Php Version7.0.5

Php ≫ Php Version7.0.6

Php ≫ Php Version7.0.7

Php ≫ Php Version7.0.8

Php ≫ Php Version7.0.9

Php ≫ Php Version7.0.10

Php ≫ Php Version7.0.11

Php ≫ Php Version7.0.12

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.4%	0.602

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:P/A:N

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://php.net/ChangeLog-5.php

Vendor Advisory

Release Notes

http://php.net/ChangeLog-7.php

Vendor Advisory

Release Notes

https://security.netapp.com/advisory/ntap-20180112-0001/

http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=b061fa909de77085d3822a89ab901b934d0362c4

http://openwall.com/lists/oss-security/2017/07/10/6

Patch

Third Party Advisory

Mailing List