CVE-2016-15039: 
Linux Debian vulnerability analysis and mitigation

A critical vulnerability was discovered in mhuertos phpLDAPadmin up to version 665dbc2690ebeb5392d38f1fece0a654225a0b38. The vulnerability affects the makeHttpRequest function in the file htdocs/js/ajax_functions.js and is related to HTTP request smuggling. This security issue was assigned CVE-2016-15039 and can be exploited remotely (NVD).

The vulnerability exists in the makeHttpRequest function within htdocs/js/ajax_functions.js file. The issue stems from improper handling of HTTP headers that could lead to request smuggling attacks. The vulnerability has received a CVSS v3.1 Base Score of 6.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The weakness is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests) (NVD, VulDB).

The vulnerability allows remote attackers to perform HTTP request smuggling attacks, which could potentially lead to unauthorized access, information disclosure, and system compromise. The attack impacts the confidentiality, integrity, and availability of the system, each with a low severity rating as indicated by the CVSS metrics (NVD).

A patch has been released to address this vulnerability. The fix is implemented in commit dd6e9583a2eb2ca085583765e8a63df5904cb036. The patch removes potentially dangerous header settings that could lead to request smuggling. It is recommended to update to the patched version immediately (GitHub).