CVE-2016-10397 Security feature bypass in n/a
Attackers can bypass hostname-specific URL checks in PHP applications by exploiting incorrect URI component handling in the URL parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-10397?
CVE-2016-10397 is a high-severity vulnerability in Php Php, published on 10 Jul 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as demonstrated by evil.example.com:80#@good.example.com/ and evil.example.com:[email protected]/ inputs to the parse_url function (implemented in the php_url_parse_ex function in ext/standard/url.c).
Weakness: CWE-20
Which versions are affected by CVE-2016-10397?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2016-10397?
Upgrade to a fixed version.
Is CVE-2016-10397 being exploited?
There is no known exploitation of CVE-2016-10397 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as GHSA-25h5-rq96-q5mq, UBUNTU-CVE-2016-10397.