What is the CVSS score of CVE-2016-2016?

CVE-2016-2016 has a CVSS 3.0 base score of 5.5 (Medium). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2016-2016?

Yes, a patch is available for CVE-2016-2016. Update the affected software to the latest version immediately.

Base Vxfs 50 CVE-2016-2016

MEDIUM

Improper Access Control (CWE-284)

2016-05-14 cve@mitre.org

HP Authentication Bypass Base Vxfs 50 Base Vxfs 501 Base Vxfs 51

5.5

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

May 14, 2016 - 15:59 cve.org

MEDIUM 5.5

DescriptionCVE.org

Base-VxFS-50 B.05.00.01 through B.05.00.02, Base-VxFS-501 B.05.01.0 through B.05.01.03, and Base-VxFS-51 B.05.10.00 through B.05.10.02 on HPE HP-UX 11iv3 with VxFS 5.0, VxFS 5.0.1, and VxFS 5.1SP1 mishandles ACL inheritance for default:class: entries, default:other: entries, and default:user: entries, which allows local users to bypass intended access restrictions by leveraging the configuration of a parent directory.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-284. Base-VxFS-50 B.05.00.01 through B.05.00.02, Base-VxFS-501 B.05.01.0 through B.05.01.03, and Base-VxFS-51 B.05.10.00 through B.05.10.02 on HPE HP-UX 11iv3 with VxFS 5.0, VxFS 5.0.1, and VxFS 5.1SP1 mishandles ACL inheritance for default:class: entries, default:other: entries, and default:user: entries, which allows local users to bypass intended access restrictions by leveraging the configuration of a parent directory. Affected products include: Hp Base-Vxfs-50, Hp Base-Vxfs-501, Hp Base-Vxfs-51.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.