How severe is CVE-2016-7964?

This vulnerability has a severity rating of HIGH with a CVSS score of 8.6 out of 10.

What type of vulnerability is CVE-2016-7964?

This is classified as CWE-918, which is a common weakness in software security.

CVE-2016-7964

HIGH Year: 2016

CVSS v3 Score

8.6

High

CVSS v2 Score

4.3

Medium

Weakness Type

CWE-918

View all →

Vulnerability Description

The sendRequest method in HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when media file fetching is enabled, has no way to restrict access to private networks. This allows users to scan ports of internal networks via SSRF, such as 10.0.0.1/8, 172.16.0.0/12, and 192.168.0.0/16.

CVE-2016-4029

HIGH

CVSS:8.6(High)

WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via ...

CWE-9182016

CVE-2016-6483

HIGH

CVSS:8.6(High)

The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.2.2 Patch Level 6, 4.2.3 before Patch Level 2, 5.x before 5....

CWE-9182016

CVE-2016-6621

HIGH

CVSS:8.6(High)

The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.

CWE-9182016

CVE-2016-9752

HIGH

CVSS:8.6(High)

In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status code.

CWE-9182016