← back
CVE-2016-1543

CVE-2016-1543

EPSS 71.9%
The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary user passwords by sending an action packet to xmlrpc after an authorization failure.
Affected products
n/a · n/a
public PoCs found — 5
cve_referencepacketstormsecurity.com/files/136462/BMC-Server-Automation-BSA-RSCD-Agent-Unauthorized-Password-Reset.htmlunverifiedcve_referencewww.exploit-db.com/exploits/43902/unverifiedcve_referencewww.exploit-db.com/exploits/43939/unverifiedexploitdbwww.exploit-db.com/exploits/43902unverifiedexploitdbwww.exploit-db.com/exploits/43939unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://packetstormsecurity.com/files/136462/BMC-Server-Automation-BSA-RSCD-Agent-Unauthorized-Password-Reset.htmlhttps://selfservice.bmc.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA214000000dBpnCAE&type=Solutionhttps://www.exploit-db.com/exploits/43902/https://www.exploit-db.com/exploits/43939/https://www.insinuator.net/2016/03/bmc-bladelogic-cve-2016-1542-and-cve-2016-1543/http://www.securityfocus.com/archive/1/537910/100/0/threaded