CVE-2016-15057

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-15057
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum. This issue affects Apache Continuum: all versions. Attackers with access to the installations REST API can use this to invoke arbitrary commands on the server. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

9.9 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://lists.apache.org/thread/hbvf1ztqw2kv51khvzm5nk3mml3nm4z1 Mailing List
http://www.openwall.com/lists/oss-security/2026/01/26/1 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:continuum:*:*:*:*:*:*:*:*
History

17 Jun 2026, 00:41

Type Values Removed Values Added
Summary
  • (es) NO COMPATIBLE CUANDO ASIGNADO Neutralización Inadecuada de Elementos Especiales utilizados en un Comando ('inyección de comandos') vulnerabilidad en Apache Continuum. Este problema afecta a Apache Continuum: todas las versiones. Atacantes con acceso a la API REST de las instalaciones pueden usar esto para invocar comandos arbitrarios en el servidor. Dado que este proyecto está retirado, no planeamos lanzar una versión que solucione este problema. Se recomienda a los usuarios que encuentren una alternativa o restrinjan el acceso a la instancia a usuarios de confianza. NOTA: Esta vulnerabilidad solo afecta a productos que ya no son compatibles por el mantenedor.

27 Jan 2026, 20:29

Type Values Removed Values Added
References () https://lists.apache.org/thread/hbvf1ztqw2kv51khvzm5nk3mml3nm4z1 - () https://lists.apache.org/thread/hbvf1ztqw2kv51khvzm5nk3mml3nm4z1 - Mailing List
References () http://www.openwall.com/lists/oss-security/2026/01/26/1 - () http://www.openwall.com/lists/oss-security/2026/01/26/1 - Mailing List, Third Party Advisory
CPE cpe:2.3:a:apache:continuum:*:*:*:*:*:*:*:*
First Time Apache continuum
Apache

26 Jan 2026, 19:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/01/26/1 -

26 Jan 2026, 15:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.9

26 Jan 2026, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-26 12:15

Updated : 2026-06-17 00:41

NVD link : CVE-2016-15057

Mitre link : CVE-2016-15057

CVE.ORG link : CVE-2016-15057

JSON object : View

Products Affected

apache

  • continuum
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')