Home  >  CVE-2016-5062
CVE Details for CVE: CVE-2016-5062
Summary
The web server in Aternity before 9.0.1 does not require authentication for getMBeansFromURL loading of Java MBeans, which allows remote attackers to execute arbitrary Java code by registering MBeans.
Timestamps
Last major update 10-04-2017 - 01:59
Published 29-09-2016 - 10:59
Last modified 10-04-2017 - 01:59
References
Vulnerable Configurations
  • cpe:2.3:a:aternity:aternity:9.0:*:*:*:*:*:*:*
    cpe:2.3:a:aternity:aternity:9.0:*:*:*:*:*:*:*
CAPEC
Click the CAPEC title to display a description
CWE
CWE-669
CVSS
Base
9.3
Impact
10.0
Exploitability
8.6
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
CVSS3
Base
9.8
Impact
5.9
Exploitability
3.9
Access
Attack ComplexityAttack vectorPrivileges RequiredScopeUser Interaction
LOW NETWORK NONE UNCHANGED NONE
Impact
ConfidentialityIntegrityAvailability
HIGH HIGH HIGH
VIA4 references
cvss-vector via4
AV:N/AC:M/Au:N/C:C/I:C/A:C
cvss3-vector via4
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
refmap via4
bid 93208
cert-vn VU#706359