CVE-2016-10397
In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as demonstrated by evil.example.com:80#@good.example.com/ and…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.91%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as demonstrated by evil.example.com:80#@good.example.com/ and evil.example.com:80?@good.example.com/ inputs to the parse_url function (implemented in the php_url_parse_ex function in ext/standard/url.c).
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 1.91% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- php/php
- Source
- cve@mitre.org
References
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=b061fa909de77085d3822a89ab901b934d0362c4
- http://openwall.com/lists/oss-security/2017/07/10/6Mailing List, Patch, Third Party Advisory
- http://php.net/ChangeLog-5.phpRelease Notes, Vendor Advisory
- http://php.net/ChangeLog-7.phpRelease Notes, Vendor Advisory
- http://www.securityfocus.com/bid/99552
- https://bugs.php.net/bug.php?id=73192Issue Tracking, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20180112-0001/
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=b061fa909de77085d3822a89ab901b934d0362c4
- http://openwall.com/lists/oss-security/2017/07/10/6Mailing List, Patch, Third Party Advisory
- http://php.net/ChangeLog-5.phpRelease Notes, Vendor Advisory
- http://php.net/ChangeLog-7.phpRelease Notes, Vendor Advisory
- http://www.securityfocus.com/bid/99552
- https://bugs.php.net/bug.php?id=73192Issue Tracking, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20180112-0001/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.