High severity · published Jan 18, 2017
CVE-2016-10086
RESTful web services in CA Service Desk Manager 12.9 and CA Service Desk Management 14.1 might allow remote authenticated users to read or modify task information by leveraging…
8.1
CVSS
1.6%
EPSS
No
On KEV
Description
RESTful web services in CA Service Desk Manager 12.9 and CA Service Desk Management 14.1 might allow remote authenticated users to read or modify task information by leveraging incorrect permissions applied to a RESTful request.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
Service Desk Management · CA
14.1 · source: NVD
SD
Service Desk Manager · CA
12.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-10086
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-10086
Third Party Advisory
http://www.securityfocus.com/bid/95366
Third Party Advisory
http://www.securitytracker.com/id/1037583
Patch
https://www.ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20170109-01-security-notice-for-ca-service-desk-manager.html