PT-2016-6014
CVE-2016-4553
·
Published
2016-05-10
·
Updated
2024-06-15
Description by
CVSS 3.1
8.6
HighMetricsAV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
Squid versions prior to 3.5.18
Squid versions 4.x prior to 4.0.10
Description
The issue allows remote attackers to conduct cache-poisoning attacks via an HTTP request, due to the failure to properly ignore the Host header when an absolute-URI is provided.
Recommendations
For Squid versions prior to 3.5.18, update to version 3.5.18 or later.
For Squid versions 4.x prior to 4.0.10, update to version 4.0.10 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾