CVE-2016-5062

Published: Sep 29, 2016Modified: May 6, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The web server in Aternity before 9.0.1 does not require authentication for getMBeansFromURL loading of Java MBeans, which allows remote attackers to execute arbitrary Java code by registering MBeans.

Affected (1)

Products: Aternity: Aternity

Aternity

1 product

Aternity

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Aternity Aternity	Up to 9.0

Related CWEs

CWE-669

Incorrect Resource Transfer Between Spheres

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

References (4)

http://www.kb.cert.org/vuls/id/706359

Source: cret@cert.org

Third Party AdvisoryUS Government Resource

http://www.securityfocus.com/bid/93208

Source: cret@cert.org

http://www.kb.cert.org/vuls/id/706359

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

http://www.securityfocus.com/bid/93208

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.