CVE-2016-10517

networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis…

published October 24, 2017

CVSS
—
EPSS
2%
Percentile
81.8
In the wild
Unconfirmed
What it is

networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis protocol (but commonly occur when an attack triggers an HTTP request to the Redis TCP port).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02147 · 81.8th percentile
Published
2017-10-24T18:00Z
EPSS history
Timeline
  • 24 OCT 18:00Z
    networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis…
    cvelistv5