What’s Vulnerable › Vulnerabilities

CVE-2016-7955

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-03-15 · updated 2026-06-17
• Weakness: CWE-264

Description

The logcheck function in session.inc in AlienVault OSSIM before 5.3.1, when an action has been created, and USM before 5.3.1 allows remote attackers to bypass authentication and consequently obtain sensitive information, modify the application, or execute arbitrary code as root via an "AV Report Scheduler" HTTP User-Agent header.

Affected products

• Alienvault Ossim: through 5.3
• Alienvault Unified Security Management: through 5.3

References

• http://www.securityfocus.com/archive/1/540224/100/0/threaded
• http://www.zerodayinitiative.com/advisories/ZDI-16-517/
• https://www.alienvault.com/forums/discussion/7765/alienvault-v5-3-1-hotfix
• http://www.securityfocus.com/archive/1/540224/100/0/threaded
• http://www.zerodayinitiative.com/advisories/ZDI-16-517/
• https://www.alienvault.com/forums/discussion/7765/alienvault-v5-3-1-hotfix

Get alerted when CVE-2016-7955 or the next vulnerability affects your stack