Httpoxy Vulnerability Through CGI Servlet

🗓️ 04 Apr 2017 04:22:07Reported by Veracode Vulnerability DatabaseType

veracode

veracode🔗 sca.analysiscenter.veracode.com👁 33 Views

Httpoxy Vulnerability in web-core CGI Servle

Reporter	Title	Published	Views	Family All 143
IBM Security Bulletins	Release of QRadar 7.2.8 Patch 4 (7.2.8.20170224202650) Updated w/Security Bulletins	10 May 201914:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Business Intelligence Server 2017Q1 Security Updater : IBM Cognos Business Intelligence Server is affected by multiple vulnerabilities.	15 Jun 201823:17	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat affect the IBM FlashSystem models 840 and 900	18 Feb 202301:45	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM Cognos Business Intelligence shipped with IBM Cognos Planning (CVE-2016-5388).	25 Jun 201805:54	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat affect the IBM FlashSystem model V840	18 Jun 201800:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Disconnected Log Collector is vulnerable to using components with known vulnerabilities	16 Jun 202221:33	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Tomcat Vulnerabilities Affect IBM Sterling B2B Integrator	29 Apr 202502:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Cast Iron Solution is affected by Apache Tomcat vulnerability (CVE-2016-5388)	18 Nov 201913:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to various CGI vulnerabilities. (CVE-2016-5385, CVE-2016-5387, CVE-2016-5388)	16 Jun 201821:48	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Apache Tomcat affect SAN Volume Controller, Storwize family and FlashSystem V9000 products	29 Mar 202301:48	–	ibm

Vulners

Node

-core_servlet_containerMatch10.0-b28

OR

-core_servlet_containerRange≤3.2-b06

OR

-core_servlet_containerRange≤4.1.2

Source	Link
github	www.github.com/payara/Payara/pull/1051
github	www.github.com/payara/Payara/commit/67ffd436595a998f66a7fc045558b22e2c1cbcb4
securityfocus	www.securityfocus.com/bid/101364
securitytracker	www.securitytracker.com/id/1039606
sourceclear	www.sourceclear.com/blog/How-we-found-exploitable-zero-days-in-the-open-source-GlassFish-server-with-the-Security-Graph-Language/
oracle	www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

03 Oct 2019 07:09Current

6.8Medium risk

Vulners AI Score6.8

CVSS 26.8

CVSS 38.1

EPSS0.3676

SSVC

httpoxy vulnerability cgi servlet web-core configuration web.xml cgi script proxy header environment variables man-in-the-middle attacks cve-2016-5388 software