HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs.

Published 8 y ago 2018-02-15 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.4%

percentile 72%

Public exploits

none known

HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated users with S3 permissions could also access versioned data.

Exploit prediction (EPSS)

1.36% probability of exploitation in the next 30 days, higher than 72% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	8.8	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	6.5	`AV:N/AC:L/Au:S/C:P/I:P/A:P`

Affected products

Hewlett Packard Enterprise Helion Eucalyptus

Classification

Weakness

CWE-275 Permission Issues

References

securityfocus.com /bid/95369 · vdb-entry, x_refsource_BID, x_transferred
support.hpe.com /hpsc/doc/public/display?docId=emr_na-c05363782 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2016-8520
NVD: CVE-2016-8520

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.