CVE-2016-1543

High

Published: 13/06/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) versions 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary user passwords by sending an action packet to xmlrpc after an authorization failure.

Risk Assessment

Attackers may gain access to user accounts, potentially leading to unauthorized access to organizational systems and data.

Recommendation

It is recommended to upgrade to the latest version of BMC BladeLogic Server Automation and implement additional security measures to restrict access to the RPC API.

Other vulnerabilities in BMC BladeLogic Server Automation (BSA) w wersjach 8.2.x, 8.3.x, 8.5.x, 8.6.x i 8.7.x

CVE-2016-1542High
The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) versions 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and enumerate users by sending an action packet to xmlrpc after an authorization failure.

Original NVD description (English source)

The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary user passwords by sending an action packet to xmlrpc after an authorization failure.