Sign-up

ID

VAR-201704-1019


CVE

CVE-2016-8779


TITLE

Huawei FusionAccess Vulnerabilities in which important information is obtained from databases

Trust: 0.8

sources: JVNDB: JVNDB-2016-008222

DESCRIPTION

Huawei FusionAccess with software V100R005C10 and V100R005C20 could allow remote attackers with specific permission to inject a Lightweight Directory Access Protocol (LDAP) operation command into a specific input variable to obtain sensitive information from the database. Huawei FusionAccess is prone to a command-injection vulnerability. An attacker may leverage this issue to inject arbitrary commands and obtain sensitive information. Huawei FusionAccess is a desktop management system of Huawei's FusionCloud desktop cloud solution developed by China's Huawei (Huawei). The system can distribute, maintain and reclaim virtual desktops for users through a graphical Portal interface. A command injection vulnerability exists in Huawei FusionAccess

Trust: 1.98

sources: NVD: CVE-2016-8779 // JVNDB: JVNDB-2016-008222 // BID: 94620 // VULHUB: VHN-97599

AFFECTED PRODUCTS

vendor:huaweimodel:fusionaccessscope:eqversion:v100r005c10

Trust: 2.4

vendor:huaweimodel:fusionaccessscope:eqversion:v100r005c20

Trust: 2.4

vendor:huaweimodel:fusionaccess v100r005c20scope: - version: -

Trust: 0.3

vendor:huaweimodel:fusionaccess v100r005c10scope: - version: -

Trust: 0.3

vendor:huaweimodel:fusionaccess v100r005c30spc105scope:neversion: -

Trust: 0.3

sources: BID: 94620 // JVNDB: JVNDB-2016-008222 // CNNVD: CNNVD-201612-008 // NVD: CVE-2016-8779

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-8779
value: MEDIUM

Trust: 1.0

NVD: CVE-2016-8779
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201612-008
value: MEDIUM

Trust: 0.6

VULHUB: VHN-97599
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2016-8779
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-97599
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-8779
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-97599 // JVNDB: JVNDB-2016-008222 // CNNVD: CNNVD-201612-008 // NVD: CVE-2016-8779

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:CWE-90

Trust: 0.8

sources: JVNDB: JVNDB-2016-008222 // NVD: CVE-2016-8779

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201612-008

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201612-008

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-008222

PATCH
title:huawei-sa-20161130-01-ldapurl:http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161130-01-ldap-en
Trust: 0.8
title:Huawei FusionAccess Fixes for command injection vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=65990
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2016-008222 // 
            
            
            
            CNNVD: CNNVD-201612-008

EXTERNAL IDS
db:NVDid:CVE-2016-8779
Trust: 2.8
db:BIDid:94620
Trust: 2.0
db:JVNDBid:JVNDB-2016-008222
Trust: 0.8
db:CNNVDid:CNNVD-201612-008
Trust: 0.7
db:VULHUBid:VHN-97599
Trust: 0.1
sources:
            
            
            VULHUB: VHN-97599 // 
            
            
            
            BID: 94620 // 
            
            
            
            JVNDB: JVNDB-2016-008222 // 
            
            
            
            CNNVD: CNNVD-201612-008 // 
            
            
            
            NVD: CVE-2016-8779

REFERENCES
url:http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161130-01-ldap-en
Trust: 2.0
url:http://www.securityfocus.com/bid/94620
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-8779
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2016-8779
Trust: 0.8
url:http://www.huawei.com
Trust: 0.3
sources:
            
            
            VULHUB: VHN-97599 // 
            
            
            
            BID: 94620 // 
            
            
            
            JVNDB: JVNDB-2016-008222 // 
            
            
            
            CNNVD: CNNVD-201612-008 // 
            
            
            
            NVD: CVE-2016-8779

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 94620

SOURCES
db:VULHUBid:VHN-97599
db:BIDid:94620
db:JVNDBid:JVNDB-2016-008222
db:CNNVDid:CNNVD-201612-008
db:NVDid:CVE-2016-8779

LAST UPDATE DATE
2025-04-20T23:29:43.033000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-97599date:2017-04-05T00:00:00
db:BIDid:94620date:2016-12-20T02:04:00
db:JVNDBid:JVNDB-2016-008222date:2017-05-02T00:00:00
db:CNNVDid:CNNVD-201612-008date:2016-12-02T00:00:00
db:NVDid:CVE-2016-8779date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:VULHUBid:VHN-97599date:2017-04-02T00:00:00
db:BIDid:94620date:2016-12-01T00:00:00
db:JVNDBid:JVNDB-2016-008222date:2017-05-02T00:00:00
db:CNNVDid:CNNVD-201612-008date:2016-12-02T00:00:00
db:NVDid:CVE-2016-8779date:2017-04-02T20:59:01.530