Evil-DB LogoEvil-DB
← All CVEs

CVE-2016-1543

high · 7.5

The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary user passwords by sending an action packet to xmlrpc after an authorization failure.

7.5
CVSS
71.9%
EPSS (exploit prob.)
99th
EPSS percentile
2016-06-13
Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses

CWE-284

Affected products

VendorProductAffected versions
bmcbladelogic_server_automation_console8.2.02
bmcbladelogic_server_automation_console8.2.03
bmcbladelogic_server_automation_console8.2.04
bmcbladelogic_server_automation_console8.3.00
bmcbladelogic_server_automation_console8.3.01
bmcbladelogic_server_automation_console8.3.02
bmcbladelogic_server_automation_console8.3.03
bmcbladelogic_server_automation_console8.5.00
bmcbladelogic_server_automation_console8.5.01
bmcbladelogic_server_automation_console8.6.00
bmcbladelogic_server_automation_console8.7.00

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2016-1543