CVE-2016-3166 Drupal CRLF injection vulnerability in the drupal_set_header function
MediumCVSS 5.9
EPSS 1.2%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
CRLF injection vulnerability in the drupal_set_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP headers.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal/core(Packagist) | >= 6.0, < 6.38 | 6.38 |
| drupal/drupal(Packagist) | >= 6.0, < 6.38 | 6.38 |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| drupal/drupal | = 6.0 | No fix listed |
| drupal/drupal | = 6.0-beta1 | No fix listed |
| drupal/drupal | = 6.0-beta2 | No fix listed |
| drupal/drupal | = 6.0-beta3 | No fix listed |
| drupal/drupal | = 6.0-beta4 | No fix listed |
| drupal/drupal | = 6.0-dev | No fix listed |
| drupal/drupal | = 6.0-rc1 | No fix listed |
| drupal/drupal | = 6.0-rc2 | No fix listed |
| drupal/drupal | = 6.0-rc3 | No fix listed |
| drupal/drupal | = 6.0-rc4 | No fix listed |
| drupal/drupal | = 6.1 | No fix listed |
| drupal/drupal | = 6.2 | No fix listed |
| drupal/drupal | = 6.3 | No fix listed |
| drupal/drupal | = 6.4 | No fix listed |
| drupal/drupal | = 6.5 | No fix listed |
| drupal/drupal | = 6.6 | No fix listed |
| drupal/drupal | = 6.7 | No fix listed |
| drupal/drupal | = 6.8 | No fix listed |
| drupal/drupal | = 6.9 | No fix listed |
| drupal/drupal | = 6.10 | No fix listed |
| drupal/drupal | = 6.11 | No fix listed |
Show 26 more
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal/drupal | = 6.12 | No fix listed |
| drupal/drupal | = 6.13 | No fix listed |
| drupal/drupal | = 6.14 | No fix listed |
| drupal/drupal | = 6.15 | No fix listed |
| drupal/drupal | = 6.16 | No fix listed |
| drupal/drupal | = 6.17 | No fix listed |
| drupal/drupal | = 6.18 | No fix listed |
| drupal/drupal | = 6.19 | No fix listed |
| drupal/drupal | = 6.20 | No fix listed |
| drupal/drupal | = 6.21 | No fix listed |
| drupal/drupal | = 6.22 | No fix listed |
| drupal/drupal | = 6.23 | No fix listed |
| drupal/drupal | = 6.24 | No fix listed |
| drupal/drupal | = 6.25 | No fix listed |
| drupal/drupal | = 6.26 | No fix listed |
| drupal/drupal | = 6.27 | No fix listed |
| drupal/drupal | = 6.28 | No fix listed |
| drupal/drupal | = 6.29 | No fix listed |
| drupal/drupal | = 6.30 | No fix listed |
| drupal/drupal | = 6.31 | No fix listed |
| drupal/drupal | = 6.32 | No fix listed |
| drupal/drupal | = 6.33 | No fix listed |
| drupal/drupal | = 6.34 | No fix listed |
| drupal/drupal | = 6.35 | No fix listed |
| drupal/drupal | = 6.36 | No fix listed |
| drupal/drupal | = 6.37 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit
- github.com exploit
- github.com product
- www.drupal.org patch vendor-advisory
- DSA-3498 vendor-advisory
- [oss-security] 20160224 CVE requests for Drupal core (SA-CORE-2016-001) mailing-list
- [oss-security] 20160315 Re: CVE requests for Drupal core (SA-CORE-2016-001) mailing-list
- github.com