CVE-2016-3427

Oracle Java SE and JRockit Unspecified

9.8 CRITICALActively exploited (CISA KEV)EPSS 92.3%

Published21 Apr 2016
Added to CISA KEV12 May 2023
Remediation due2 Jun 2023

Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

Added to KEV: 12 May 2023Federal remediation due: 2 Jun 2023

Description

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Apache Cassandra≥ 2.1.0 < 2.1.22 · ≥ 2.2.0 < 2.2.18 · ≥ 3.0.0 < 3.0.22 · ≥ 3.11.0 < 3.11.8

Netapp E-series Santricity Management Plug-insall versions

Netapp E-series Santricity Storage Managerall versions

Netapp E-series Santricity Web Servicesall versions

Netapp Oncommand Balanceall versions

Netapp Oncommand Cloud Managerall versions

Netapp Oncommand Insightall versions

Netapp Oncommand Performance Managerall versions

Netapp Oncommand Reportall versions

Netapp Oncommand Shiftall versions

Netapp Oncommand Unified Managerall versions

Netapp Oncommand Workflow Automationall versions

Netapp Storagegrid≤ 9.0.4

Netapp Vasa Provider For Clustered Data Ontap≥ 7.2

Netapp Virtual Storage Console≥ 7.2

Oracle Jdk1.6.0 · 1.7.0 · 1.8.0

Oracle Jre1.6.0 · 1.7.0 · 1.8.0

Oracle Jrockitr28.3.9

Redhat Satellite5.6 · 5.7

Suse Linux Enterprise Module For Legacy12

Suse Manager2.1

Suse Manager Proxy2.1

Suse Openstack Cloud5

Canonical Ubuntu Linux12.04 · 14.04 · 15.10 · 16.04

Remediation

Fixed in

Apache Cassandra≥ 2.1.22

Patch & vendor advisories

References

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00006.htmlMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00009.htmlMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00012.htmlMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00021.htmlMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00022.htmlMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00026.htmlMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00027.htmlMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.htmlMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00040.htmlMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00042.htmlMailing ListThird Party Advisory

and 50 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2016-3427 being actively exploited?

Yes. CVE-2016-3427 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 12 May 2023.

How severe is CVE-2016-3427?

CVE-2016-3427 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 92.3% probability of exploitation.

Which products are affected by CVE-2016-3427?

Affected products include Apache Cassandra, Netapp E-series Santricity Management Plug-ins, Netapp E-series Santricity Storage Manager, Netapp E-series Santricity Web Services, Netapp Oncommand Balance, and 19 more.

How do I fix CVE-2016-3427?

Upgrade affected software to a fixed version, for example Apache Cassandra 2.1.22 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2016-3427 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.