Description

Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

Remediation

References

CVE-2016-1000111

Related Vulnerabilities

SharePoint CVE-2020-1503 Vulnerability (CVE-2020-1503)

Dot CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-3938)

WordPress Plugin Spam protection, AntiSpam, FireWall by CleanTalk Cross-Site Scripting (5.127.3)

WordPress Plugin Blog2Social:Social Media Auto Post & Scheduler SQL Injection (5.5.0)

WordPress Plugin GD Star Rating 'de' Parameter SQL Injection (1.9.10)

Severity

Medium

Classification

CVE-2016-1000111 CWE-425 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities