Vulnerability Description
PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2. These vulnerabilities allow arbitrary PHP code execution via magic methods in included classes.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alienvault | Open Source Security Information And Event Management | <= 5.3.1 |
| Alienvault | Unified Security Management | <= 5.3.1 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/93864
- https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5Vendor Advisory
- https://www.exploit-db.com/exploits/40682/
- http://www.securityfocus.com/bid/93864
- https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5Vendor Advisory
- https://www.exploit-db.com/exploits/40682/
FAQ
What is CVE-2016-8580?
CVE-2016-8580 is a vulnerability with a CVSS score of 9.8 (CRITICAL). PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2. These vulnerabilities allow arbitrary PHP code execution via magic methods in included cla...
How severe is CVE-2016-8580?
CVE-2016-8580 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-8580?
Check the references section above for vendor advisories and patch information. Affected products include: Alienvault Open Source Security Information And Event Management, Alienvault Unified Security Management.