CVE-2016-8582 EXPLOIT
9.8
CRITICAL · CVSS 3.0 · EPSS 57.4% (pctl 99)
Patch early
A public exploit exists.
Description
A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOAD_FILE.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 57.43% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2016-10-28 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| alienvault | open source security information and event management |
| alienvault | unified security management |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Alienvault OSSIM/USM 5.3.1 - SQL Injection | 2016-11-02 |
References
- http://www.securityfocus.com/bid/93866
- https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities
- https://www.exploit-db.com/exploits/40684/
- http://www.securityfocus.com/bid/93866
- https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities
- https://www.exploit-db.com/exploits/40684/
→ the Explorer · watch your stack · NVD