PT-2016-6232 · Riverbed · Aternity

Matthew Benton + 1 · Published 2016-09-29 · Updated 2017-04-10 · CVE-2016-5062

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aternity versions prior to 9.0.1

Description The issue concerns the web server in Aternity, which does not require authentication for loading of Java MBeans using getMBeansFromURL. This allows remote attackers to execute arbitrary Java code by registering MBeans.

Recommendations For versions prior to 9.0.1, update to version 9.0.1 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-669

Related Identifiers

CVE-2016-5062

Affected Products

Aternity

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-5062 · Security Note
• https://osv.dev/vulnerability/CVE-2016-5062 · Vendor Advisory
• http://securityfocus.com/bid/93208 · Note
• http://kb.cert.org/vuls/id/706359 · Note