CVE-2016-7955

moderate-risk
Published 2017-03-15

The logcheck function in session.inc in AlienVault OSSIM before 5.3.1, when an action has been created, and USM before 5.3.1 allows remote attackers to bypass authentication and consequently obtain sensitive information, modify the application, or execute arbitrary code as root via an "AV Report Scheduler" HTTP User-Agent header.

Do I need to act?

~
8.6% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Alienvault

References (6)

http://www.securityfocus.com/archive/1/540224/100/0/threaded
Third Party Advisory http://www.zerodayinitiative.com/advisories/ZDI-16-517/
Vendor Advisory https://www.alienvault.com/forums/discussion/7765/alienvault-v5-3-1-hotfix
http://www.securityfocus.com/archive/1/540224/100/0/threaded
Third Party Advisory http://www.zerodayinitiative.com/advisories/ZDI-16-517/
Vendor Advisory https://www.alienvault.com/forums/discussion/7765/alienvault-v5-3-1-hotfix
49
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 10/34 · Low
Exposure 7/34 · Low