CVE-2016-3166

EUVD-2022-3773
CRLF injection vulnerability in the drupal_set_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP headers.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 65%
Affected Products (NVD)
VendorProductVersion
debiandebian_linux
7.0
debiandebian_linux
8.0
drupaldrupal
6.0
drupaldrupal
6.0:beta1
drupaldrupal
6.0:beta2
drupaldrupal
6.0:beta3
drupaldrupal
6.0:beta4
drupaldrupal
6.0:dev
drupaldrupal
6.0:rc1
drupaldrupal
6.0:rc2
drupaldrupal
6.0:rc3
drupaldrupal
6.0:rc4
drupaldrupal
6.1
drupaldrupal
6.2
drupaldrupal
6.3
drupaldrupal
6.4
drupaldrupal
6.5
drupaldrupal
6.6
drupaldrupal
6.7
drupaldrupal
6.8
drupaldrupal
6.9
drupaldrupal
6.10
drupaldrupal
6.11
drupaldrupal
6.12
drupaldrupal
6.13
drupaldrupal
6.14
drupaldrupal
6.15
drupaldrupal
6.16
drupaldrupal
6.17
drupaldrupal
6.18
drupaldrupal
6.19
drupaldrupal
6.20
drupaldrupal
6.21
drupaldrupal
6.22
drupaldrupal
6.23
drupaldrupal
6.24
drupaldrupal
6.25
drupaldrupal
6.26
drupaldrupal
6.27
drupaldrupal
6.28
drupaldrupal
6.29
drupaldrupal
6.30
drupaldrupal
6.31
drupaldrupal
6.32
drupaldrupal
6.33
drupaldrupal
6.34
drupaldrupal
6.35
drupaldrupal
6.36
drupaldrupal
6.37
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
drupal6
precise
not-affected
trusty
dne
wily
dne
drupal7
precise
not-affected
trusty
not-affected
wily
not-affected
References
http://www.debian.org/security/2016/dsa-3498
http://www.openwall.com/lists/oss-security/2016/02/24/19
http://www.openwall.com/lists/oss-security/2016/03/15/10
https://www.drupal.org/SA-CORE-2016-001
http://www.debian.org/security/2016/dsa-3498
http://www.openwall.com/lists/oss-security/2016/02/24/19
http://www.openwall.com/lists/oss-security/2016/03/15/10
https://www.drupal.org/SA-CORE-2016-001