CVE-2016-3702
published 2017-04-21CVE-2016-3702: Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information.
PriorityP425medium5.3CVSS 3.0
AVNACLPRNUINSUCLINAN
EPSS
1.24%
65.6th percentile
Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | cloudforms_management_engine | — | — |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-ggp3-m938-r93p: Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information
ghsa_unreviewed·2022-05-17
CVE-2016-3702 [MEDIUM] CWE-200 GHSA-ggp3-m938-r93p: Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information
Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information.
Red Hat
cfme: vulnerable to padding oracle attack against AES-256-CBC
vendor_redhat·2016-04-25·CVSS 5.3
CVE-2016-3702 [MEDIUM] CWE-327 cfme: vulnerable to padding oracle attack against AES-256-CBC
cfme: vulnerable to padding oracle attack against AES-256-CBC
Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information.
A padding oracle flaw was found in the encryption of sensitive information stored within the backend database used by CloudForms. An attacker able to submit forged cipher texts could observe the results of encryption and determine information that could, in turn, lead to the disclosure of encrypted data within the database.
Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/cla
No detection rules found.
No public exploits indexed.
2017-04-21
Published