VULNERABILITY INTELLIGENCE
CVE-2016-5397
CVSS score8.8 HIGH
EPSS probability6.87%
CISA KEVNot currently listed
Published2018-02-12
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
Weakness classification
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Primary references
- security@apache.org — Mailing List, Vendor Advisory
- security@apache.org — Third Party Advisory, VDB Entry
- security@apache.org
- security@apache.org
- security@apache.org — Vendor Advisory
- security@apache.org
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108