PT-2017-9807 · Huawei · Huawei Fusionaccess

Publicado 2017-04-02 · Atualizado 2017-04-05 · CVE-2016-8779

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Huawei FusionAccess versions V100R005C10 through V100R005C20

Description The issue allows remote attackers with specific permission to inject a Lightweight Directory Access Protocol (LDAP) operation command into a specific input variable, potentially obtaining sensitive information from the database.

Recommendations For versions V100R005C10 and V100R005C20, consider restricting access to the input variable that allows LDAP operation command injection to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2016-8779

Produtos afetados

Huawei Fusionaccess

Referências · 4

• http://huawei.com/en/psirt/security-advisories/huawei-sa-20161130-01-ldap-en · Aviso do Fabricante
• http://securityfocus.com/bid/94620 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-8779 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-8779 · Aviso do Fabricante