CVE-2016-1542

High

Published: 13/06/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) versions 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and enumerate users by sending an action packet to xmlrpc after an authorization failure.

Risk Assessment

Attackers can gain access to user information, potentially leading to further attacks on the system. This poses a serious threat to data security within the organization.

Recommendation

It is recommended to upgrade to the latest version of BMC BladeLogic Server Automation to eliminate this vulnerability. Additionally, implementing extra security measures to restrict access to the RPC API is advisable.

Other vulnerabilities in BMC BladeLogic Server Automation (BSA) w wersjach 8.2.x, 8.3.x, 8.5.x, 8.6.x i 8.7.x

CVE-2016-1543High
The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) versions 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary user passwords by sending an action packet to xmlrpc after an authorization failure.

Original NVD description (English source)

The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and enumerate users by sending an action packet to xmlrpc after an authorization failure.