#VU194 Environment variable injection in TYPO3 in TYPO3 and Oracle Linux - CVE-2016-5385

Vulnerability identifier: #VU194

Vulnerability risk: High

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Amber

CVE-ID: CVE-2016-5385

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
TYPO3
Oracle Linux

Software vendor:
TYPO3
Oracle

The vulnerability allows a remote attacker to redirect an application's outbound HTTP traffic.

The vulnerability exists in TYPO3 CMS. A remote attacker can redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request.

Successful exploitation of this vulnerability may result in XSS attack and data injection.

Install the latest version 8.2.1.

• https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-019/
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html