Advisory details:
vulnrichment / CVE-2016-6816
| Advisory ID | vulnrichment/CVE-2016-6816 |
| Aliases | |
| Summary | The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| ssvc | Track |
| Data source | Exploit-DB |
|---|---|
| Date added | April 3, 2017 |
| Description | Apache Tomcat 6/7/8/9 - Information Disclosure |
| Ransomware campaign use | Unknown |
| Source publication date | April 4, 2017 |
| Exploit type | remote |
| Platform | multiple |
| Source update date | April 3, 2017 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2023-12-12T21:25:30Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2016/6xxx/CVE-2016-6816.json
Source Advisory: vulnrichment/CVE-2016-6816
[{'Exploitation': 'none'},
{'Automatable': 'no'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]