CVE-2016-10002

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jan 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-10002138.8Ruckus Wireless H500 web management interface CSRF CVE-2016-10002145.3Ruckus Wireless H500 web management interface authentication bypass CVE-2016-10002157.5Ruckus Wireless H500 web management interface denial of service CVE-2016-10002168.8Ruckus Wireless H500 web management interface authenticated command injection CVE-2016-10002179.8Zotpress plugin for WordPress SQLi in zp_get_account()CVE-2016-10002188.8Kibana Reporting plugin version 2.4.0 is vulnerable to a CSRF vulnerability that could allow an attacker to generate superfluous reports whe CVE-2016-10002197.5Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the CVE-2016-10002206.1Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browse CVE-2016-10002217.5Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive info CVE-2016-10002227.5Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data.CVE-2016-10002296.1swagger-ui has XSS in key names CVE-2016-10002325.3NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result