Description

Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).

Remediation

References

CVE-2016-4975

Related Vulnerabilities

WordPress Plugin Scout bazar Cross-Site Scripting (1.3.3)

WordPress Plugin Contact Form by WD-responsive drag & drop contact form builder tool Security Bypass (1.7.14)

Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2020-19216)

WordPress Plugin WP Safe Search 'v1' Parameter Cross-Site Scripting (0.7)

PHP Other Vulnerability (CVE-2004-1392)

Severity

Medium

Classification

CVE-2016-4975 CWE-707 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Tags

Missing Update Known Vulnerabilities