CVE-2016-5302 Auth bypass in n/a
Remote attackers on the management network can compromise hosts using Active Directory credentials in upgraded Citrix XenServer deployments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-5302?
CVE-2016-5302 is a critical authentication bypass vulnerability in Citrix Xenserver, published on 13 Jun 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Citrix XenServer 7.0 before Hotfix XS70E003, when a deployment has been upgraded from an earlier release, might allow remote attackers on the management network to "compromise" a host by leveraging credentials for an Active Directory account.
Weakness: CWE-284
Which versions are affected by CVE-2016-5302?
It affects 1 product.
Products include Citrix Xenserver.
How do I fix CVE-2016-5302?
No fix has been published for CVE-2016-5302 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2016-5302 being exploited?
There is no known exploitation of CVE-2016-5302 in the wild and no public exploit code.
Other vulnerabilities in Citrix Xenserver
Sources
Also known as GHSA-jwf4-87xw-25r6.