« Volver al listado

CVE-2016-8779

Estado: ModificadaMedia (6.5)—

Huawei FusionAccess with software V100R005C10 and V100R005C20 could allow remote attackers with specific permission to inject a Lightweight Directory Access Protocol (LDAP) operation command into a specific input variable to obtain sensitive information from the database.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Huawei — Fusionaccess

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-8779",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@huawei.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "FusionAccess FusionAccess V100R005C10, FusionAccess V100R005C20",
          "versions": [
            {
              "status": "affected",
              "version": "FusionAccess FusionAccess V100R005C10, FusionAccess V100R005C20"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-04-02T20:59:01.530",
  "references": [
    {
      "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161130-01-ldap-en",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@huawei.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/94620",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@huawei.com"
    },
    {
      "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161130-01-ldap-en",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/94620",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Huawei FusionAccess with software V100R005C10 and V100R005C20 could allow remote attackers with specific permission to inject a Lightweight Directory Access Protocol (LDAP) operation command into a specific input variable to obtain sensitive information from the database."
    },
    {
      "lang": "es",
      "value": "Huawei FusionAccess con software V100R005C10 y V100R005C20 podrían permitir a atacantes remotos con permisos específicos inyectar un comando de operación Lightweight Directory Access Protocol (LDAP) en una variable de entrada específica para obtener información sensible de la base de datos."
    }
  ],
  "lastModified": "2026-06-17T00:54:59.393",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:huawei:fusionaccess:v100r005c10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9DA9180-AEB7-46A1-8AF8-BB26CA9FC460"
            },
            {
              "criteria": "cpe:2.3:a:huawei:fusionaccess:v100r005c20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3399737D-23AE-448B-A6C2-52815AE4902F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/90.html\">CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')</a>",
  "sourceIdentifier": "psirt@huawei.com"
}