Httpoxy Vulnerability Through CGI Servlet

web-core is vulnerable to a remotely exploitable vulnerability aka “httpoxy”. The vulnerability exists when CGI Servlet is activated in the configuration by modifying the web.xml. It then allows the execution of a CGI script which may assign client request Proxy header values to internal HTTP_PROXY environment variables. Therefore, attackers can conduct man-in-the-middle (MITM) attacks on internal subrequests or to redirect HTTP traffic to an address and port of their choosing or other malicious proxy. This artifact is related to CVE-2016-5388.