PT-2018-4972 · Red Hat · Red Hat Jboss Enterprise Application Platform

Bharti Kundal · Published 2018-09-11 · Updated 2019-10-09 · CVE-2016-7066

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform versions prior to 7.1.0

Description The issue arises from improper default permissions on the /tmp/auth directory, allowing any local user to connect to the CLI and execute arbitrary operations.

Recommendations For versions prior to 7.1.0, update to version 7.1.0 or later to resolve the issue.

Fix

Incorrect Privilege Assignment

Weakness Enumeration

CWE-275

CWE-266

Related Identifiers

CVE-2016-7066

Affected Products

Red Hat Jboss Enterprise Application Platform

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-7066 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7066 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3456 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-7066 · Vendor Advisory