Lucene search

[email protected]CVE-2016-5726

HistoryFeb 09, 2017 - 3:59 p.m.

CVE-2016-5726

2017-02-0915:59:01

CWE-94

[email protected]

web.nvd.nist.gov

smf 2.1

packages.php

php object injection

themechanges

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.4%

JSON

Packages.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter.

Affected configurations

NVD

Node

simplemachinessimple_machines_forumMatch2.1

CPENameOperatorVersion
simplemachines:simple_machines_forumsimplemachines simple machines forumeq2.1

CPE	Name	Operator	Version
simplemachines:simple_machines_forum	simplemachines simple machines forum	eq	2.1

References

www.openwall.com/lists/oss-security/2016/06/10/7

www.openwall.com/lists/oss-security/2016/06/18/1

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.4%

JSON

Related for CVE-2016-5726

cvelist1 prion1 nvd1