CVE-2016-1000109

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. This issue affects HHVM versions prior to 3.9.6, all versions between 3.10.0 and 3.12.4 (inclusive), and all versions between 3.13.0 and 3.14.2 (inclusive).

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-665

Affected software

No affected versions have been published.

Timeline

Published
Feb 19, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-10001106.1The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow CVE-2016-10001115.3Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applicationCVE-2016-10001129.1Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress pluginCVE-2016-10001139.8XSS and SQLi in huge IT gallery v1.1.5 for JoomlaCVE-2016-10001146.1XSS in huge IT gallery v1.1.5 for JoomlaCVE-2016-10001157.2Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and XSSCVE-2016-10001167.2Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and XSSCVE-2016-10001177.2XSS & SQLi in HugeIT slideshow v1.0.4CVE-2016-10001187.2XSS & SQLi in HugeIT slideshow v1.0.4CVE-2016-10001197.2SQLi and XSS in Huge IT catalog extension v1.0.4 for JoomlaCVE-2016-10001207.2SQLi and XSS in Huge IT catalog extension v1.0.4 for JoomlaCVE-2016-10001214.8XSS and SQLi in Huge IT Joomla Slider v1.0.9 extension