CVE-2016-6649

MediumCVSS 6.7/10Last modified Jul 10, 2026

Description

EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0 are affected by multiple command injection vulnerabilities where a malicious administrator with configuration privileges may bypass the user interface and escalate his privileges to root.

Metrics

CVSS 3.0 6.7/10CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	EMC RecoverPoint and EMC RecoverPoint for Virtual Machines EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0	EMC RecoverPoint and EMC RecoverPoint for Virtual Machines EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0

References

http://www.securityfocus.com/archive/1/540058/30/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/95821Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037727Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/540058/30/0/threadedThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/95821Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037727Third Party Advisory, VDB Entry

Timeline

Published: Feb 3, 2017
Last modified: Jul 10, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-66507.5EMC RecoverPoint versions prior to 5.0 and EMC RecoverPoint for Virtual Machines versions prior to 5.0 have an SSL Stripping Vulnerability t CVE-2016-66518.8The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5;CVE-2016-66525.6SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a re CVE-2016-66537.5The MariaDB audit_plugin component in Pivotal Cloud Foundry (PCF) cf-mysql-release 27 and 28 allows remote attackers to obtain sensitive inf CVE-2016-66559.8An issue was discovered in Cloud Foundry Foundation Cloud Foundry release versions prior to v245 and cf-mysql-release versions prior to v31.CVE-2016-66567.2An issue was discovered in Pivotal Greenplum before 4.3.10.0. Creation of external tables using GPHDFS protocol has a vulnerability whereby CVE-2016-66577.4An open redirect vulnerability has been detected with some Pivotal Cloud Foundry Elastic Runtime components. Users of affected versions shou CVE-2016-66589.6Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpa CVE-2016-66598.1Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release (aka uaa-rel CVE-2016-66629.8Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before CVE-2016-66637.0Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; MariaDB before 5.5.52, 10.0.x CVE-2016-66647.0mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server before 5.5.51-38.2, 5.6.