CVE-2016-1543
Last modified
CVE-2016-1543 is a vulnerability of currently unknown severity. The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary user passwords by sending an action packet to xmlrpc after an authorization failure.. EPSS estimates a 71.85% chance of exploitation in the next 30 days.
Description
The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary user passwords by sending an action packet to xmlrpc after an authorization failure.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Bmc | Bladelogic Server Automation Console | 8.2.02 |
| Bmc | Bladelogic Server Automation Console | 8.2.03 |
| Bmc | Bladelogic Server Automation Console | 8.2.04 |
| Bmc | Bladelogic Server Automation Console | 8.3.00 |
| Bmc | Bladelogic Server Automation Console | 8.3.01 |
| Bmc | Bladelogic Server Automation Console | 8.3.02 |
| Bmc | Bladelogic Server Automation Console | 8.3.03 |
| Bmc | Bladelogic Server Automation Console | 8.5.00 |
| Bmc | Bladelogic Server Automation Console | 8.5.01 |
| Bmc | Bladelogic Server Automation Console | 8.6.00 |
| Bmc | Bladelogic Server Automation Console | 8.7.00 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-1543?
How severe is CVE-2016-1543?
How do I fix CVE-2016-1543?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2016
- CVE-2016-1524Multiple unrestricted file upload vulnerabilities in NETGEAR…
- CVE-2016-1525Directory traversal vulnerability in data/config/image.do in…
- CVE-2016-1526The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphit…
- CVE-2016-1531Exim before 4.86.2, when installed setuid root, allows local…
- CVE-2016-1541Heap-based buffer overflow in the zip_read_mac_metadata func…
- CVE-2016-1542The RPC API in RSCD agent in BMC BladeLogic Server Automatio…
- CVE-2016-1544nghttp2 before 1.7.1 allows remote attackers to cause a deni…3.3
- CVE-2016-1546The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is …
- CVE-2016-1547An off-path attacker can cause a preemptible client associat…
- CVE-2016-1548An attacker can spoof a packet from a legitimate ntpd server…
- CVE-2016-1549A malicious authenticated peer can create arbitrarily-many e…
- CVE-2016-1550An exploitable vulnerability exists in the message authentic…
Are you affected by CVE-2016-1543?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST