PT-2016-6232 · Riverbed · Aternity

Matthew Benton + 1 · Publicado 2016-09-29 · Atualizado 2017-04-10 · CVE-2016-5062

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aternity versions prior to 9.0.1

Description The issue concerns the web server in Aternity, which does not require authentication for loading of Java MBeans using getMBeansFromURL. This allows remote attackers to execute arbitrary Java code by registering MBeans.

Recommendations For versions prior to 9.0.1, update to version 9.0.1 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-669

Identificadores relacionados

CVE-2016-5062

Produtos afetados

Aternity

Referências · 4

• http://securityfocus.com/bid/93208 · Nota
• http://kb.cert.org/vuls/id/706359 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-5062 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-5062 · Aviso do Fabricante