CVE-2016-150571 exploit
Apache Continuum: Command injection leading to RCE
Also known as GHSA-77p9-w6pj-rmvg
Published 9 mo ago · modified 4 mo ago · JSON
Summary
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum.
This issue affects Apache Continuum: all versions.
Attackers with access to the installations REST API can use this to invoke arbitrary commands on the server.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 9 mo ago
Exploit prediction (EPSS)
3.89% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.
Exploits and detections
- Metasploit exploit/linux/http/apache_continuum_cmd_exec Apache Continuum Arbitrary Command Execution · metasploit exploit, excellent rank · 2016-04-06
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| CNA | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.continuum:continuum | <=1.4.2 | no fix listed |
Affected products
- Apache Software Foundation Apache Continuum
Classification
- Weakness
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
- lists.apache.org /thread/hbvf1ztqw2kv51khvzm5nk3mml3nm4z1 · vendor-advisory
- openwall.com /lists/oss-security/2026/01/26/1
- nvd.nist.gov /vuln/detail/CVE-2016-15057 · advisory
- github.com /apache/continuum · package
Sources
- CVE List: CVE-2016-15057
- GitHub Advisory: GHSA-77p9-w6pj-rmvg
- NVD: CVE-2016-15057
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.