CVE-2016-4553
client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote…
published May 10, 2016
Patch now
High probability of exploitation
NVD has not assigned a CVSS score to this record. It sits in the 99.6th percentile for exploit probability.
What it is
client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request.
The record
Technical detail
- CVSS
- Not scored
- CVSS v4.0
- Not supplied
- EPSS
- 0.79969 · 99.6th percentile
- Published
- 2016-05-10T19:00Z
EPSS history
Timeline