CVE-2016-9165

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-03-20 · updated 2026-06-17
Weakness: CWE-200

Description

The get_sessions servlet in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) before 8.5 and CA Unified Infrastructure Management Snap (formerly CA Nimsoft Monitor Snap) allows remote attackers to obtain active session ids and consequently bypass authentication or gain privileges via unspecified vectors.

Affected products

CA Technologies Unified Infrastructure Management: through 8.47
Ca Unified Infrastructure Management Snap: through 8.47

References

http://www.securityfocus.com/bid/94257
http://www.zerodayinitiative.com/advisories/ZDI-16-606
https://www.ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20161109-01-security-notice-for-ca-unified-infrastructure-mgmt.html
http://www.securityfocus.com/bid/94257
http://www.zerodayinitiative.com/advisories/ZDI-16-606
https://www.ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20161109-01-security-notice-for-ca-unified-infrastructure-mgmt.html

Get alerted when CVE-2016-9165 or the next vulnerability affects your stack