PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5803 Ca Technologies CVE debrief

CVE-2016-5803 affects CA Unified Infrastructure Management version 8.47 and earlier. NVD describes a path traversal weakness where external input is used to build a pathname without properly neutralizing ".." sequences, allowing access outside a restricted directory. The issue is network exploitable without authentication and is scored 8.6 (HIGH) by NVD.

Vendor
Ca Technologies
Product
Unified Infrastructure Management
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2016-08-14
Original CVE updated
2025-06-05
Advisory published
2016-08-14
Advisory updated
2025-06-05

Who should care

Administrators, vulnerability management teams, and SOC/incident response staff responsible for CA Unified Infrastructure Management deployments at version 8.47 or earlier.

Technical summary

NVD maps this issue to CWE-22 (Path Traversal). The vulnerability is exposed over the network with no privileges or user interaction required (CVSS: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). According to the supplied NVD record, affected versions extend through 8.47. The core problem is unsafe pathname construction from external input, which can permit traversal outside the intended directory boundary.

Defensive priority

High. This is an unauthenticated, network-reachable path traversal issue with high confidentiality impact, so exposed CA UIM instances should be prioritized for patching or mitigation ahead of lower-severity issues.

Recommended defensive actions

  • Apply the vendor remediation guidance from the CA security notice and the corresponding ICS-CERT advisory for CA Unified Infrastructure Management.
  • Upgrade or replace any CA Unified Infrastructure Management deployment running version 8.47 or earlier.
  • Restrict network access to the management interface until remediation is complete, especially from untrusted or broadly reachable networks.
  • Review file access, application, and web logs for unexpected path patterns or attempts to reference parent-directory sequences such as "..".
  • Validate that any local compensating controls still prevent directory traversal after remediation, including input handling and path normalization checks.

Evidence notes

The supplied NVD record lists CVE-2016-5803 as published on 2017-02-13 and modified on 2026-05-13. It identifies CA Technologies Unified Infrastructure Management versions through 8.47 as vulnerable, assigns CWE-22, and gives CVSS v3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. Supporting references in the source corpus include the ICS-CERT advisory, the SecurityFocus BID entry, and the CA security notice.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-5803 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-5803

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-5803 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-5803

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://ics-cert.us-cert.gov/advisories/ICSA-16-315-01

    [email protected] - Mitigation, Third Party Advisory, US Government Resource

  • Source reference

    Unverified legacy reference

    URL: https://www.ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20161109-01-security-notice-for-ca-unified-infrastructure-mgmt.html

    [email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.