7.2high
CVE-2016-6656
An issue was discovered in Pivotal Greenplum before 4.3.10.0.
Published 9 y ago · modified 4 mo ago · JSON
CVSS
7.2
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.1%
percentile 66%
Public exploits
0
none known
Summary
An issue was discovered in Pivotal Greenplum before 4.3.10.0. Creation of external tables using GPHDFS protocol has a vulnerability whereby arbitrary commands can be injected into the system. In order to exploit this vulnerability the user must have superuser 'gpadmin' access to the system or have been granted GPHDFS protocol permissions in order to create a GPHDFS external table.
Exploit prediction (EPSS)
1.11% probability of exploitation in the next 30 days, higher than 66% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.2 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- n/a Pivotal Greenplum 4.3.0.0 to 4.3.9.1 and older versions that are end of life
Classification
- Weakness
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
- pivotal.io /security/cve-2016-6656 · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/94954 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2016-6656
- NVD: CVE-2016-6656
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.