CVE-2016-5422

The web console in Red Hat JBoss Operations Network (JON) before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain admin privileges via a crafted POST request.

• CWE-264

• http://rhn.redhat.com/errata/RHSA-2016-1785.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/92722Third Party Advisory, VDB Entry
• http://rhn.redhat.com/errata/RHSA-2016-1785.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/92722Third Party Advisory, VDB Entry

Published

Sep 7, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-5416389 Directory Server in Red Hat Enterprise Linux Desktop 6 t…
• CVE-2016-5417Memory leak in the __res_vinit function in the IPv6 name ser…
• CVE-2016-5418The sandboxing code in libarchive 3.2.0 and earlier mishandl…
• CVE-2016-5419curl and libcurl before 7.50.1 do not prevent TLS session re…
• CVE-2016-5420curl and libcurl before 7.50.1 do not check the client certi…
• CVE-2016-5421Use-after-free vulnerability in libcurl before 7.50.1 allows…8.1
• CVE-2016-5423PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before …
• CVE-2016-5424PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before …
• CVE-2016-5425The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fed…7.8
• CVE-2016-5426PowerDNS (aka pdns) Authoritative Server before 3.4.10 allow…
• CVE-2016-5427PowerDNS (aka pdns) Authoritative Server before 3.4.10 does …
• CVE-2016-5428Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…