CVE-2016-1000107

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Dec 10, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-10001086.1yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications fr CVE-2016-10001095.3HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presen CVE-2016-10001106.1The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow CVE-2016-10001115.3Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI application CVE-2016-10001129.1Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin CVE-2016-10001139.8XSS and SQLi in huge IT gallery v1.1.5 for Joomla CVE-2016-10001146.1XSS in huge IT gallery v1.1.5 for Joomla CVE-2016-10001157.2Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and XSS CVE-2016-10001167.2Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and XSS CVE-2016-10001177.2XSS & SQLi in HugeIT slideshow v1.0.4 CVE-2016-10001187.2XSS & SQLi in HugeIT slideshow v1.0.4 CVE-2016-10001197.2SQLi and XSS in Huge IT catalog extension v1.0.4 for Joomla