QwikSec

Security Database

CVE

CWE

Training

CVE-2016-7955

Published: Mar 15, 2017

Modified: Aug 6, 2024

PUBLISHED

Description

The logcheck function in session.inc in AlienVault OSSIM before 5.3.1, when an action has been created, and USM before 5.3.1 allows remote attackers to bypass authentication and consequently obtain sensitive information, modify the application, or execute arbitrary code as root via an "AV Report Scheduler" HTTP User-Agent header.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

20170306 CVE-2016-7955 - Alienvault OSSIM/USM Authentication Bypass

mailing-list

x_refsource_BUGTRAQ

http://www.zerodayinitiative.com/advisories/ZDI-16-517/

x_refsource_MISC

https://www.alienvault.com/forums/discussion/7765/alienvault-v5-3-1-hotfix

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.