Lucene search

MitreCVE-2016-9165

HistoryMar 20, 2017 - 4:59 p.m.

CVE-2016-9165

2017-03-2016:59:01

CWE-200

mitre

web.nvd.nist.gov

ca unified infrastructure management

nimsoft monitor

cve-2016-9165

security vulnerability

authentication bypass

privilege escalation

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.9

Confidence

High

EPSS

0.035

Percentile

91.7%

JSON

The get_sessions servlet in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) before 8.5 and CA Unified Infrastructure Management Snap (formerly CA Nimsoft Monitor Snap) allows remote attackers to obtain active session ids and consequently bypass authentication or gain privileges via unspecified vectors.

Affected configurations

Nvd

Node

caunified_infrastructure_managementRange≤8.47

caunified_infrastructure_management_snapRange≤8.47

VendorProductVersionCPE
caunified_infrastructure_management*cpe:2.3:a:ca:unified_infrastructure_management:*:*:*:*:*:*:*:*
caunified_infrastructure_management_snap*cpe:2.3:a:ca:unified_infrastructure_management_snap:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ca	unified_infrastructure_management	*	cpe:2.3:a:ca:unified_infrastructure_management::::::::
ca	unified_infrastructure_management_snap	*	cpe:2.3:a:ca:unified_infrastructure_management_snap::::::::

References

www.securityfocus.com/bid/94257

www.zerodayinitiative.com/advisories/ZDI-16-606

www.ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20161109-01-security-notice-for-ca-unified-infrastructure-mgmt.html

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.9

Confidence

High

EPSS

0.035

Percentile

91.7%

JSON

Related for CVE-2016-9165