PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2.

published 2016-10-28 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-9427

cvss: 9.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 6.9%; EPSS 6.9% chance of exploitation in 30 days, percentile 94%
public exploits: 2; Exploit-DB

PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2. These vulnerabilities allow arbitrary PHP code execution via magic methods in included classes.

Timeline

2016-10-28 Published
2016-11-02 First public exploit (EDB-40682)

Exploit prediction

6.86% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-41424 AlienVault OSSIM/USM < 5.3.1 - Remote Code Execution (Metasploit) webapps, 2017-01-31
EDB-40682 Alienvault OSSIM/USM 5.3.1 - PHP Object Injection webapps, 2016-11-02

CVSS scores

assigned by	version	score	vector
NVD	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-284 Improper Access Control

References

exploit-db.com /exploits/40682/
exploit
alienvault.com /forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities
vendor-advisory
securityfocus.com /bid/93864
vdb-entry

Sources

CVE List CVE-2016-8580
NVD CVE-2016-8580

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary