{
  "threat_severity" : "Important",
  "public_date" : "2017-12-13T00:00:00Z",
  "bugzilla" : {
    "description" : "admin-cli: Any local users can connect to jboss-cli",
    "id" : "1401661",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1401661"
  },
  "cvss" : {
    "cvss_base_score" : "6.1",
    "cvss_scoring_vector" : "AV:L/AC:L/Au:N/C:P/I:P/A:C",
    "status" : "verified"
  },
  "cwe" : "CWE-266",
  "details" : [ "It was found that the improper default permissions on /tmp/auth directory in JBoss Enterprise Application Platform before 7.1.0 can allow any local user to connect to CLI and allow the user to execute any arbitrary operations.", "It was found that the improper default permissions on /tmp/auth directory in EAP 7 can allow any local user to connect to CLI and allow the user to execute any arbitrary operations." ],
  "acknowledgement" : "This issue was discovered by Jeremy Choi (Red Hat).",
  "affected_release" : [ {
    "product_name" : "Red Hat JBoss EAP 7",
    "release_date" : "2017-12-13T00:00:00Z",
    "advisory" : "RHSA-2017:3456",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7",
    "fix_state" : "Affected",
    "package_name" : "keycloak-admin-client",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2016-7066\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-7066" ],
  "name" : "CVE-2016-7066",
  "csaw" : false
}