CVE-2016-5062

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The web server in Aternity before 9.0.1 does not require authentication for getMBeansFromURL loading of Java MBeans, which allows remote attackers to execute arbitrary Java code by registering MBeans.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-669

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.kb.cert.org/vuls/id/706359Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/93208
http://www.kb.cert.org/vuls/id/706359Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/93208

Timeline

Published: Sep 29, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-50635.3The RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows might allow remote attackers to bypass auth CVE-2016-50659.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Embedded_Ace_Set_Task.cgi command injection.CVE-2016-50669.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 have weak passwords for admin, rauser, sconsole, and user.CVE-2016-50678.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Hayes AT command injection.CVE-2016-50689.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 do not require authentication for Embedded_Ace_Get_Task.cgi requests.CVE-2016-50699.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in the URL.CVE-2016-50709.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 store passwords in cleartext.CVE-2016-50718.8Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 execute the management web application as root.CVE-2016-50728.8OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions CVE-2016-50736.1CloudView NMS before 2.10a has XSS via SNMP.CVE-2016-50749.8CloudView NMS before 2.10a has a format string issue exploitable over SNMP.CVE-2016-50756.1CloudView NMS before 2.10a has XSS via a TELNET login.