CVE-2016-7066

Impact:
Important
Public Date:
2017-12-13
CWE:
CWE-266
Bugzilla:
1401661: CVE-2016-7066 admin-cli: Any local users can connect to jboss-cli
It was found that the improper default permissions on /tmp/auth directory in EAP 7 can allow any local user to connect to CLI and allow the user to execute any arbitrary operations.

Find out more about CVE-2016-7066 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v2 metrics

Base Score 6.1
Base Metrics AV:L/AC:L/Au:N/C:P/I:P/A:C
Access Vector Local
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Complete

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat JBoss EAP 7 RHSA-2017:3456 2017-12-13

Acknowledgements

This issue was discovered by Jeremy Choi (Red Hat).
Last Modified