Lucene search

DellCVE-2016-0910

HistoryJun 10, 2016 - 1:59 a.m.

CVE-2016-0910

2016-06-1001:59:01

CWE-264

dell

web.nvd.nist.gov

emc

data domain os

cve-2016-0910

session identifier

gui

vulnerability

hijack

local users

nvd

CVSS2

4.3

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.1

Confidence

High

EPSS

Percentile

5.1%

JSON

EMC Data Domain OS 5.5 before 5.5.4.0, 5.6 before 5.6.1.004, and 5.7 before 5.7.2.0 stores session identifiers of GUI users in a world-readable file, which allows local users to hijack arbitrary accounts via unspecified vectors.

Affected configurations

Nvd

Node

emcdata_domain_osRange≤5.5.3.3

emcdata_domain_osRange≤5.6.1.0

emcdata_domain_osRange≤5.7.1.0

VendorProductVersionCPE
emcdata_domain_os*cpe:2.3:o:emc:data_domain_os:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
emc	data_domain_os	*	cpe:2.3:o:emc:data_domain_os::::::::

References

seclists.org/bugtraq/2016/Jun/44

www.securitytracker.com/id/1036074

CVSS2

4.3

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.1

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2016-0910