CVE-2016-5410

CWE-287 — Improper AuthenticationCWE-306 — Missing Authentication8 documents7 sources
Severity
5.5MEDIUM
EPSS
0.1%
top 81.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Firewalld FirewalldRedhat Enterprise Linux DesktopRedhat Enterprise Linux HPC Node+2 more
Timeline
PublishedApr 19
Latest updateMay 17

Description

firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough, (2) removePassthrough, (3) addEntry, (4) removeEntry, or (5) setEntries D-Bus API method.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages6 packages

▶Debianfirewalld< 0.4.3.3-1+3
▶NVDfirewalld/firewalld0.4.3.2

Patches

Patch: www.firewalld.org ↗Patch: bugzilla.redhat.com ↗Patch: www.firewalld.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-v2vf-88f9-4px7: firewalld↗2022-05-17
▶
OSV
CVE-2016-5410: firewalld↗2017-04-19
▶
CVEList
CVE-2016-5410: firewalld↗2017-04-19
▶

📋Vendor Advisories

2
Red Hat
firewalld: Firewall configuration can be modified by any logged in user↗2016-08-16
▶
Debian
CVE-2016-5410: firewalld - firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentica...↗2016
▶

💬Community

2
Bugzilla
CVE-2016-5410 firewalld: Firewall configuration can be modified by any logged in user [fedora-all]↗2016-08-16
▶
Bugzilla
CVE-2016-5410 firewalld: Firewall configuration can be modified by any logged in user↗2016-07-26
▶