Vulnerability Details CVE-2016-5388
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.326
EPSS Ranking 96.6%
CVSS Severity
CVSS v3 Score 8.1
CVSS v2 Score 5.1
Products affected by CVE-2016-5388
-
cpe:2.3:a:apache:tomcat:6.0
-
cpe:2.3:a:apache:tomcat:6.0.0
-
cpe:2.3:a:apache:tomcat:6.0.1
-
cpe:2.3:a:apache:tomcat:6.0.10
-
cpe:2.3:a:apache:tomcat:6.0.11
-
cpe:2.3:a:apache:tomcat:6.0.12
-
cpe:2.3:a:apache:tomcat:6.0.13
-
cpe:2.3:a:apache:tomcat:6.0.14
-
cpe:2.3:a:apache:tomcat:6.0.15
-
cpe:2.3:a:apache:tomcat:6.0.16
-
cpe:2.3:a:apache:tomcat:6.0.17
-
cpe:2.3:a:apache:tomcat:6.0.18
-
cpe:2.3:a:apache:tomcat:6.0.19
-
cpe:2.3:a:apache:tomcat:6.0.2
-
cpe:2.3:a:apache:tomcat:6.0.20
-
cpe:2.3:a:apache:tomcat:6.0.21
-
cpe:2.3:a:apache:tomcat:6.0.22
-
cpe:2.3:a:apache:tomcat:6.0.23
-
cpe:2.3:a:apache:tomcat:6.0.24
-
cpe:2.3:a:apache:tomcat:6.0.25
-
cpe:2.3:a:apache:tomcat:6.0.26
-
cpe:2.3:a:apache:tomcat:6.0.27
-
cpe:2.3:a:apache:tomcat:6.0.28
-
cpe:2.3:a:apache:tomcat:6.0.29
-
cpe:2.3:a:apache:tomcat:6.0.3
-
cpe:2.3:a:apache:tomcat:6.0.30
-
cpe:2.3:a:apache:tomcat:6.0.31
-
cpe:2.3:a:apache:tomcat:6.0.32
-
cpe:2.3:a:apache:tomcat:6.0.33
-
cpe:2.3:a:apache:tomcat:6.0.34
-
cpe:2.3:a:apache:tomcat:6.0.35
-
cpe:2.3:a:apache:tomcat:6.0.36
-
cpe:2.3:a:apache:tomcat:6.0.37
-
cpe:2.3:a:apache:tomcat:6.0.38
-
cpe:2.3:a:apache:tomcat:6.0.4
-
cpe:2.3:a:apache:tomcat:6.0.40
-
cpe:2.3:a:apache:tomcat:6.0.41
-
cpe:2.3:a:apache:tomcat:6.0.42
-
cpe:2.3:a:apache:tomcat:6.0.43
-
cpe:2.3:a:apache:tomcat:6.0.44
-
cpe:2.3:a:apache:tomcat:6.0.45
-
cpe:2.3:a:apache:tomcat:6.0.5
-
cpe:2.3:a:apache:tomcat:6.0.6
-
cpe:2.3:a:apache:tomcat:6.0.7
-
cpe:2.3:a:apache:tomcat:6.0.8
-
cpe:2.3:a:apache:tomcat:6.0.9
-
cpe:2.3:a:apache:tomcat:7.0
-
cpe:2.3:a:apache:tomcat:7.0.0
-
cpe:2.3:a:apache:tomcat:7.0.1
-
cpe:2.3:a:apache:tomcat:7.0.10
-
cpe:2.3:a:apache:tomcat:7.0.11
-
cpe:2.3:a:apache:tomcat:7.0.12
-
cpe:2.3:a:apache:tomcat:7.0.13
-
cpe:2.3:a:apache:tomcat:7.0.14
-
cpe:2.3:a:apache:tomcat:7.0.15
-
cpe:2.3:a:apache:tomcat:7.0.16
-
cpe:2.3:a:apache:tomcat:7.0.17
-
cpe:2.3:a:apache:tomcat:7.0.18
-
cpe:2.3:a:apache:tomcat:7.0.19
-
cpe:2.3:a:apache:tomcat:7.0.2
-
cpe:2.3:a:apache:tomcat:7.0.20
-
cpe:2.3:a:apache:tomcat:7.0.21
-
cpe:2.3:a:apache:tomcat:7.0.22
-
cpe:2.3:a:apache:tomcat:7.0.23
-
cpe:2.3:a:apache:tomcat:7.0.24
-
cpe:2.3:a:apache:tomcat:7.0.25
-
cpe:2.3:a:apache:tomcat:7.0.26
-
cpe:2.3:a:apache:tomcat:7.0.27
-
cpe:2.3:a:apache:tomcat:7.0.28
-
cpe:2.3:a:apache:tomcat:7.0.29
-
cpe:2.3:a:apache:tomcat:7.0.3
-
cpe:2.3:a:apache:tomcat:7.0.30
-
cpe:2.3:a:apache:tomcat:7.0.31
-
cpe:2.3:a:apache:tomcat:7.0.32
-
cpe:2.3:a:apache:tomcat:7.0.33
-
cpe:2.3:a:apache:tomcat:7.0.34
-
cpe:2.3:a:apache:tomcat:7.0.35
-
cpe:2.3:a:apache:tomcat:7.0.36
-
cpe:2.3:a:apache:tomcat:7.0.37
-
cpe:2.3:a:apache:tomcat:7.0.38
-
cpe:2.3:a:apache:tomcat:7.0.39
-
cpe:2.3:a:apache:tomcat:7.0.4
-
cpe:2.3:a:apache:tomcat:7.0.40
-
cpe:2.3:a:apache:tomcat:7.0.41
-
cpe:2.3:a:apache:tomcat:7.0.42
-
cpe:2.3:a:apache:tomcat:7.0.43
-
cpe:2.3:a:apache:tomcat:7.0.44
-
cpe:2.3:a:apache:tomcat:7.0.45
-
cpe:2.3:a:apache:tomcat:7.0.46
-
cpe:2.3:a:apache:tomcat:7.0.47
-
cpe:2.3:a:apache:tomcat:7.0.48
-
cpe:2.3:a:apache:tomcat:7.0.49
-
cpe:2.3:a:apache:tomcat:7.0.5
-
cpe:2.3:a:apache:tomcat:7.0.50
-
cpe:2.3:a:apache:tomcat:7.0.51
-
cpe:2.3:a:apache:tomcat:7.0.52
-
cpe:2.3:a:apache:tomcat:7.0.53
-
cpe:2.3:a:apache:tomcat:7.0.54
-
cpe:2.3:a:apache:tomcat:7.0.55
-
cpe:2.3:a:apache:tomcat:7.0.56
-
cpe:2.3:a:apache:tomcat:7.0.57
-
cpe:2.3:a:apache:tomcat:7.0.58
-
cpe:2.3:a:apache:tomcat:7.0.59
-
cpe:2.3:a:apache:tomcat:7.0.6
-
cpe:2.3:a:apache:tomcat:7.0.60
-
cpe:2.3:a:apache:tomcat:7.0.61
-
cpe:2.3:a:apache:tomcat:7.0.62
-
cpe:2.3:a:apache:tomcat:7.0.63
-
cpe:2.3:a:apache:tomcat:7.0.64
-
cpe:2.3:a:apache:tomcat:7.0.65
-
cpe:2.3:a:apache:tomcat:7.0.66
-
cpe:2.3:a:apache:tomcat:7.0.67
-
cpe:2.3:a:apache:tomcat:7.0.68
-
cpe:2.3:a:apache:tomcat:7.0.69
-
cpe:2.3:a:apache:tomcat:7.0.7
-
cpe:2.3:a:apache:tomcat:7.0.70
-
cpe:2.3:a:apache:tomcat:7.0.8
-
cpe:2.3:a:apache:tomcat:7.0.9
-
cpe:2.3:a:apache:tomcat:8.0
-
cpe:2.3:a:apache:tomcat:8.0.0
-
cpe:2.3:a:apache:tomcat:8.0.1
-
cpe:2.3:a:apache:tomcat:8.0.10
-
cpe:2.3:a:apache:tomcat:8.0.11
-
cpe:2.3:a:apache:tomcat:8.0.12
-
cpe:2.3:a:apache:tomcat:8.0.13
-
cpe:2.3:a:apache:tomcat:8.0.14
-
cpe:2.3:a:apache:tomcat:8.0.15
-
cpe:2.3:a:apache:tomcat:8.0.16
-
cpe:2.3:a:apache:tomcat:8.0.17
-
cpe:2.3:a:apache:tomcat:8.0.18
-
cpe:2.3:a:apache:tomcat:8.0.19
-
cpe:2.3:a:apache:tomcat:8.0.2
-
cpe:2.3:a:apache:tomcat:8.0.20
-
cpe:2.3:a:apache:tomcat:8.0.21
-
cpe:2.3:a:apache:tomcat:8.0.22
-
cpe:2.3:a:apache:tomcat:8.0.23
-
cpe:2.3:a:apache:tomcat:8.0.24
-
cpe:2.3:a:apache:tomcat:8.0.25
-
cpe:2.3:a:apache:tomcat:8.0.26
-
cpe:2.3:a:apache:tomcat:8.0.27
-
cpe:2.3:a:apache:tomcat:8.0.28
-
cpe:2.3:a:apache:tomcat:8.0.29
-
cpe:2.3:a:apache:tomcat:8.0.3
-
cpe:2.3:a:apache:tomcat:8.0.30
-
cpe:2.3:a:apache:tomcat:8.0.31
-
cpe:2.3:a:apache:tomcat:8.0.32
-
cpe:2.3:a:apache:tomcat:8.0.33
-
cpe:2.3:a:apache:tomcat:8.0.34
-
cpe:2.3:a:apache:tomcat:8.0.35
-
cpe:2.3:a:apache:tomcat:8.0.36
-
cpe:2.3:a:apache:tomcat:8.0.37
-
cpe:2.3:a:apache:tomcat:8.0.38
-
cpe:2.3:a:apache:tomcat:8.0.39
-
cpe:2.3:a:apache:tomcat:8.0.4
-
cpe:2.3:a:apache:tomcat:8.0.40
-
cpe:2.3:a:apache:tomcat:8.0.41
-
cpe:2.3:a:apache:tomcat:8.0.42
-
cpe:2.3:a:apache:tomcat:8.0.43
-
cpe:2.3:a:apache:tomcat:8.0.44
-
cpe:2.3:a:apache:tomcat:8.0.45
-
cpe:2.3:a:apache:tomcat:8.0.46
-
cpe:2.3:a:apache:tomcat:8.0.47
-
cpe:2.3:a:apache:tomcat:8.0.48
-
cpe:2.3:a:apache:tomcat:8.0.49
-
cpe:2.3:a:apache:tomcat:8.0.5
-
cpe:2.3:a:apache:tomcat:8.0.50
-
cpe:2.3:a:apache:tomcat:8.0.51
-
cpe:2.3:a:apache:tomcat:8.0.52
-
cpe:2.3:a:apache:tomcat:8.0.53
-
cpe:2.3:a:apache:tomcat:8.0.53-29.32.1
-
cpe:2.3:a:apache:tomcat:8.0.6
-
cpe:2.3:a:apache:tomcat:8.0.7
-
cpe:2.3:a:apache:tomcat:8.0.8
-
cpe:2.3:a:apache:tomcat:8.0.9
-
cpe:2.3:a:apache:tomcat:8.5.0
-
cpe:2.3:a:apache:tomcat:8.5.1
-
cpe:2.3:a:apache:tomcat:8.5.2
-
cpe:2.3:a:apache:tomcat:8.5.3
-
cpe:2.3:a:apache:tomcat:8.5.4
-
cpe:2.3:a:hp:system_management_homepage:-
-
cpe:2.3:a:hp:system_management_homepage:2.0.0
-
cpe:2.3:a:hp:system_management_homepage:2.0.1
-
cpe:2.3:a:hp:system_management_homepage:2.0.1.104
-
cpe:2.3:a:hp:system_management_homepage:2.0.2
-
cpe:2.3:a:hp:system_management_homepage:2.0.2.106
-
cpe:2.3:a:hp:system_management_homepage:2.1
-
cpe:2.3:a:hp:system_management_homepage:2.1.0-103
-
cpe:2.3:a:hp:system_management_homepage:2.1.0-103(a)
-
cpe:2.3:a:hp:system_management_homepage:2.1.0-109
-
cpe:2.3:a:hp:system_management_homepage:2.1.0-118
-
cpe:2.3:a:hp:system_management_homepage:2.1.0.121
-
cpe:2.3:a:hp:system_management_homepage:2.1.1
-
cpe:2.3:a:hp:system_management_homepage:2.1.10
-
cpe:2.3:a:hp:system_management_homepage:2.1.10-186
-
cpe:2.3:a:hp:system_management_homepage:2.1.10.186
-
cpe:2.3:a:hp:system_management_homepage:2.1.11
-
cpe:2.3:a:hp:system_management_homepage:2.1.11-197
-
cpe:2.3:a:hp:system_management_homepage:2.1.11.197
-
cpe:2.3:a:hp:system_management_homepage:2.1.12-118
-
cpe:2.3:a:hp:system_management_homepage:2.1.12-200
-
cpe:2.3:a:hp:system_management_homepage:2.1.12.201
-
cpe:2.3:a:hp:system_management_homepage:2.1.14
-
cpe:2.3:a:hp:system_management_homepage:2.1.14.20
-
cpe:2.3:a:hp:system_management_homepage:2.1.15
-
cpe:2.3:a:hp:system_management_homepage:2.1.15-210
-
cpe:2.3:a:hp:system_management_homepage:2.1.15.210
-
cpe:2.3:a:hp:system_management_homepage:2.1.2
-
cpe:2.3:a:hp:system_management_homepage:2.1.2-127
-
cpe:2.3:a:hp:system_management_homepage:2.1.2.127
-
cpe:2.3:a:hp:system_management_homepage:2.1.3
-
cpe:2.3:a:hp:system_management_homepage:2.1.3.132
-
cpe:2.3:a:hp:system_management_homepage:2.1.4
-
cpe:2.3:a:hp:system_management_homepage:2.1.4-143
-
cpe:2.3:a:hp:system_management_homepage:2.1.4.143
-
cpe:2.3:a:hp:system_management_homepage:2.1.5
-
cpe:2.3:a:hp:system_management_homepage:2.1.5-146
-
cpe:2.3:a:hp:system_management_homepage:2.1.5.146
-
cpe:2.3:a:hp:system_management_homepage:2.1.6
-
cpe:2.3:a:hp:system_management_homepage:2.1.6-156
-
cpe:2.3:a:hp:system_management_homepage:2.1.6.156
-
cpe:2.3:a:hp:system_management_homepage:2.1.7
-
cpe:2.3:a:hp:system_management_homepage:2.1.7-168
-
cpe:2.3:a:hp:system_management_homepage:2.1.7.168
-
cpe:2.3:a:hp:system_management_homepage:2.1.8
-
cpe:2.3:a:hp:system_management_homepage:2.1.8-177
-
cpe:2.3:a:hp:system_management_homepage:2.1.8.179
-
cpe:2.3:a:hp:system_management_homepage:2.1.9
-
cpe:2.3:a:hp:system_management_homepage:2.1.9-178
-
cpe:2.3:a:hp:system_management_homepage:2.2.6
-
cpe:2.3:a:hp:system_management_homepage:2.2.8
-
cpe:2.3:a:hp:system_management_homepage:3.0.0
-
cpe:2.3:a:hp:system_management_homepage:3.0.0-68
-
cpe:2.3:a:hp:system_management_homepage:3.0.0.64
-
cpe:2.3:a:hp:system_management_homepage:3.0.1
-
cpe:2.3:a:hp:system_management_homepage:3.0.1-73
-
cpe:2.3:a:hp:system_management_homepage:3.0.1.73
-
cpe:2.3:a:hp:system_management_homepage:3.0.2
-
cpe:2.3:a:hp:system_management_homepage:3.0.2-77
-
cpe:2.3:a:hp:system_management_homepage:3.0.2.77
-
cpe:2.3:a:hp:system_management_homepage:3.2.2
-
cpe:2.3:a:hp:system_management_homepage:3.2.7
-
cpe:2.3:a:hp:system_management_homepage:6.0
-
cpe:2.3:a:hp:system_management_homepage:6.0.0-95
-
cpe:2.3:a:hp:system_management_homepage:6.0.0.96
-
cpe:2.3:a:hp:system_management_homepage:6.1
-
cpe:2.3:a:hp:system_management_homepage:6.1.0-103
-
cpe:2.3:a:hp:system_management_homepage:6.1.0.102
-
cpe:2.3:a:hp:system_management_homepage:6.2.0
-
cpe:2.3:a:hp:system_management_homepage:6.2.2.7
-
cpe:2.3:a:hp:system_management_homepage:6.3.0
-
cpe:2.3:a:hp:system_management_homepage:6.3.1
-
cpe:2.3:a:hp:system_management_homepage:7.0
-
cpe:2.3:a:hp:system_management_homepage:7.1
-
cpe:2.3:a:hp:system_management_homepage:7.2
-
cpe:2.3:a:hp:system_management_homepage:7.2.1
-
cpe:2.3:a:hp:system_management_homepage:7.4.0
-
cpe:2.3:a:hp:system_management_homepage:7.5.3.1
-
cpe:2.3:a:hp:system_management_homepage:7.5.4.3
-
cpe:2.3:a:hp:system_management_homepage:7.5.5.0
-
-
-
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0
-
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0
-
cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0
-
cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0
-
cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.2
-
cpe:2.3:o:redhat:enterprise_linux_server:6.0
-
cpe:2.3:o:redhat:enterprise_linux_server:7.0
-
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2
-
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2
-
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2
-
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0
-
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0