7.4

CVE-2016-10517

networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis protocol (but commonly occur when an attack triggers an HTTP request to the Redis TCP port).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redislabs ≫ Redis Version < 3.2.7
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.15% 0.797
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.4 2.8 4
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.securityfocus.com/bid/101572
Third Party Advisory
VDB Entry
https://github.com/antirez/redis/commit/874804da0c014a7d704b3d285aa500098a931f50
Third Party Advisory
Issue Tracking
https://raw.githubusercontent.com/antirez/redis/3.2/00-RELEASENOTES
Third Party Advisory
Issue Tracking
https://www.reddit.com/r/redis/comments/5r8wxn/redis_327_is_out_important_security_fixes_inside/
Third Party Advisory
Issue Tracking