CVE-2016-5402

CWE-94 — Code Injection5 documents5 sources
Severity
8.8HIGH
EPSS
3.0%
top 13.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
[unknown] CfmeRedhat CloudformsRedhat Cloudforms Management Engine
Timeline
PublishedOct 31
Latest updateMay 13

Description

A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5[unknown]/cfmen/a

🔴Vulnerability Details

2
GHSA
GHSA-6p9p-cwcr-3xj6: A code injection flaw was found in the way capacity and utilization imported control files are processed↗2022-05-13
▶
CVEList
CVE-2016-5402: A code injection flaw was found in the way capacity and utilization imported control files are processed↗2018-10-31
▶

📋Vendor Advisories

1
Red Hat
cfme: RCE via Capacity & Utilization feature↗2016-11-30
▶

💬Community

1
Bugzilla
CVE-2016-5402 cfme: RCE via Capacity & Utilization feature↗2016-07-18
▶
CVE-2016-5402 (HIGH CVSS 8.8) | A code injection flaw was found in | cvebase.io