High severity · published Jul 19, 2016
CVE-2016-5388
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the…
8.1
CVSS
50.9%
EPSS
No
On KEV
Description
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)50.9% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
Tomcat · Apache
6.0 through 6.0.45; 7.0 through 7.0.70; 8.0 through 8.5.4 · source: NVD
EL
Enterprise Linux Desktop · Redhat
7.0; 6.0 · source: NVD
EL
Enterprise Linux Hpc Node · Redhat
7.0; 6.0 · source: NVD
EL
Enterprise Linux Hpc Node Eus · Redhat
7.2 · source: NVD
EL
Enterprise Linux Server · Redhat
7.0; 6.0 · source: NVD
EL
Enterprise Linux Server Aus · Redhat
7.2 · source: NVD
EL
Enterprise Linux Server Eus · Redhat
7.2 · source: NVD
EL
Enterprise Linux Server Tus · Redhat
7.2 · source: NVD
EL
Enterprise Linux Workstation · Redhat
7.0; 6.0 · source: NVD
LI
Linux · Oracle
6; 7 · source: NVD
SM
System Management Homepage · HP
through 7.5.5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-5388
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-5388
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1624.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2045.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2046.html
Third Party Advisory
http://www.kb.cert.org/vuls/id/797896
Patch
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
More from Tomcat
9.8
CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
9.8
CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
9.8
CVE-2016-8735
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…
8.1
CVE-2017-12617
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g
8.1
CVE-2017-12615
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g