High severity · published Feb 13, 2017
CVE-2016-5803
An issue was discovered in CA Unified Infrastructure Management Version 8.47 and earlier
8.6
CVSS
2.3%
EPSS
No
On KEV
Description
An issue was discovered in CA Unified Infrastructure Management Version 8.47 and earlier. The Unified Infrastructure Management software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UI
Unified Infrastructure Management · CA Technologies
through 8.47 · source: NVD
Affected product
UI
Unified Infrastructure Management
CA Technologies
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-5803
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-5803
Third Party Advisory
http://www.securityfocus.com/bid/94243
Mitigation
https://ics-cert.us-cert.gov/advisories/ICSA-16-315-01
www.ca.com
https://www.ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20161109-01-security-notice-for-ca-unified-infrastructure-mgmt.html