CVE-2016-1000111

MEDIUM EPSS 82.0%
Published Mar 11, 20206y ago · Modified Jun 17, 20262w ago
5.3 CVSS 3.1
Medium
Find Similar
Published Mar 11, 2020 6y ago
Last Modified Jun 17, 2026 2w ago

Description

Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

CVSS Details

Base Score
5.3
Exploitability
3.9
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
82.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-425

Affected Products 1

VendorProductVersionRange
twistedtwisted* <16.3.1

References 4

  • oracle.com http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
    Third Party Advisory
  • twistedmatrix.com https://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.html
    Mailing ListVendor Advisory
  • twistedmatrix.com https://twistedmatrix.com/trac/ticket/8623
    PatchVendor Advisory
  • openwall.com https://www.openwall.com/lists/oss-security/2016/07/18/6
    Mailing ListThird Party Advisory

Remediation