Evil-DB LogoEvil-DB
← All CVEs

CVE-2016-1542

high · 7.5

The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and enumerate users by sending an action packet to xmlrpc after an authorization failure.

7.5
CVSS
74.6%
EPSS (exploit prob.)
99th
EPSS percentile
2016-06-13
Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-20

Affected products

VendorProductAffected versions
bmcbladelogic_server_automation_console8.2.02
bmcbladelogic_server_automation_console8.2.03
bmcbladelogic_server_automation_console8.2.04
bmcbladelogic_server_automation_console8.3.00
bmcbladelogic_server_automation_console8.3.01
bmcbladelogic_server_automation_console8.3.02
bmcbladelogic_server_automation_console8.3.03
bmcbladelogic_server_automation_console8.5.00
bmcbladelogic_server_automation_console8.5.01
bmcbladelogic_server_automation_console8.6.00
bmcbladelogic_server_automation_console8.7.00

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2016-1542