VDB
CVE-2016-4975
CVE-2016-4975
PUBLISHED
CVSS 6.099999904632568 MEDIUM
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).
EPSS 19.80% · 97.3th percentile
Risk Scores
CVSS 3.0
6.099999904632568
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score
19.80%
97.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:14.04:LTS | apache2 | 2.4.7-1ubuntu1, 2.4.7-1ubuntu4.1, 2.4.7-1ubuntu4.4 |
| Ubuntu:16.04:LTS | apache2 | 2.4.12-2ubuntu2, 2.4.17-1ubuntu1, 2.4.17-2ubuntu1 |
Timeline
- CVE Published
- Oct 2, 2018 PoC Published
- Feb 4, 2022 EPSS Score
- Dec 17, 2024 EPSS Score
- Mar 18, 2025 EPSS Score
- Mar 23, 2025 EPSS Score
- Mar 26, 2025 EPSS Score
- Mar 29, 2025 EPSS Score
- May 1, 2025 EPSS Score
- May 4, 2025 EPSS Score
- Jun 4, 2025 EPSS Score
- Jul 1, 2025 EPSS Score
References
- https://ubuntu.com/security/CVE-2016-4975 third-party-advisory
- https://httpd.apache.org/security/vulnerabilities_22.html#CVE-2016-4975 third-party-advisory
- https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-4975 third-party-advisory
- https://ubuntu.com/security/notices/USN-3279-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2016-4975 third-party-advisory
- Nuclei Template exploit