{"api_version":"1","generated_at":"2026-07-23T02:53:28+00:00","cve":"CVE-2016-8520","urls":{"html":"https://cve.report/CVE-2016-8520","api":"https://cve.report/api/cve/CVE-2016-8520.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2016-8520","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-8520"},"summary":{"title":"CVE-2016-8520","description":"HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated users with S3 permissions could also access versioned data.","state":"PUBLIC","assigner":"security-alert@hpe.com","published_at":"2018-02-15 22:29:00","updated_at":"2018-03-13 14:15:00"},"problem_types":["CWE-275"],"metrics":[],"references":[{"url":"http://www.securityfocus.com/bid/95369","name":"95369","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"HP Helion Eucalyptus CVE-2016-8520 Security Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c05363782","name":"https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c05363782","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"Document Display | HPE Support Center","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8520","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8520","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2016","cve_id":"8520","vulnerable":"1","versionEndIncluding":"4.3.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"eucalyptus","cpe5":"eucalyptus","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-alert@hpe.com","DATE_PUBLIC":"2017-01-04T00:00:00","ID":"CVE-2016-8520","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Helion Eucalyptus","version":{"version_data":[{"version_value":"v4.3.0 and earlier"}]}}]},"vendor_name":"Hewlett Packard Enterprise"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated users with S3 permissions could also access versioned data."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Remote Unauthorized Access"}]}]},"references":{"reference_data":[{"name":"95369","refsource":"BID","url":"http://www.securityfocus.com/bid/95369"},{"name":"https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c05363782","refsource":"CONFIRM","url":"https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c05363782"}]}},"nvd":{"publishedDate":"2018-02-15 22:29:00","lastModifiedDate":"2018-03-13 14:15:00","problem_types":["CWE-275"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.5},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:eucalyptus:eucalyptus:*:*:*:*:*:*:*:*","versionEndIncluding":"4.3.0","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2016","CveId":"8520","Ordinal":"95174","Title":"CVE-2016-8520","CVE":"CVE-2016-8520","Year":"2016"},"notes":[{"CveYear":"2016","CveId":"8520","Ordinal":"1","NoteData":"HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated users with S3 permissions could also access versioned data.","Type":"Description","Title":null},{"CveYear":"2016","CveId":"8520","Ordinal":"2","NoteData":"2018-02-15","Type":"Other","Title":"Published"},{"CveYear":"2016","CveId":"8520","Ordinal":"3","NoteData":"2018-02-16","Type":"Other","Title":"Modified"}]}}}