CVE-2016-1594: Infoleak
Published Apr 22, 2016
·Updated
Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to read arbitrary attachments via a request to a LiveTime.woa URL, as demonstrated by obtaining sensitive information via a (1) downloadLogFiles or (2) downloadFile action.
Affected Software
1 affected component
Novell Service Desk<=7.1
Event History
Apr 22, 2016
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-1594?
CVE-2016-1594 has a medium severity rating due to the potential for unauthorized access to sensitive information.
2
How do I fix CVE-2016-1594?
To mitigate CVE-2016-1594, upgrade to Novell Service Desk version 7.2 or later.
3
Who is affected by CVE-2016-1594?
CVE-2016-1594 affects users of Micro Focus Novell Service Desk versions prior to 7.2.
4
What can attackers do with CVE-2016-1594?
Attackers exploiting CVE-2016-1594 can read arbitrary attachments by crafting specific requests.
5
Is CVE-2016-1594 a remote or local vulnerability?
CVE-2016-1594 is a remote vulnerability that requires authentication to exploit.