What’s Vulnerable › Vulnerabilities

CVE-2016-5402

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-10-31 · updated 2026-06-17
• Weakness: CWE-94

Description

A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as.

Affected products

• CloudForms: 4.1
• Red Hat CloudForms: 5.6

References

• http://rhn.redhat.com/errata/RHSA-2016-2839.html
• http://www.securityfocus.com/bid/94612
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-5402
• http://rhn.redhat.com/errata/RHSA-2016-2839.html
• http://www.securityfocus.com/bid/94612
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-5402

Get alerted when CVE-2016-5402 or the next vulnerability affects your stack