CVE-2016-5722

Published: Jun 24, 2016Modified: May 6, 2026

7.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.4

Source: NVD

Description

Huawei OceanStor 5300 V3, 5500 V3, 5600 V3, 5800 V3, 6800 V3, 18800 V3, and 18500 V3 before V300R003C10 sends the plaintext session token in the HTTP header, which allows remote attackers to conduct replay attacks and obtain sensitive information by sniffing the network.

Affected (2)

Products: Huawei: Ocean Stor Firmware

Huawei

1 product

Ocean Stor Firmware

Configuration A

2 platform

Running on/with	Platform Versions
Huawei Ocean Stor 18500 V3	All versions
Huawei Ocean Stor 18800 V3	All versions

Configuration B

2 vulnerable · 5 platform

Vulnerable Software	Affected Versions
Huawei Ocean Stor Firmware	Up to v300r002c10spc200
Huawei Ocean Stor Firmware	Up to v300r003c00spc100

Running on/with	Platform Versions
Huawei Ocean Stor 5300 V3	All versions
Huawei Ocean Stor 5500 V3	All versions
Huawei Ocean Stor 5600 V3	All versions
Huawei Ocean Stor 5800 V3	All versions
Huawei Ocean Stor 6800 V3	All versions

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160615-01-oceanstor-en

Source: cve@mitre.org

Vendor Advisory

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160615-01-oceanstor-en

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.