{
  "schema_version": "1.4.0",
  "id": "GHSA-fxfw-fpvf-77hw",
  "modified": "2025-04-12T12:59:58Z",
  "published": "2022-05-17T03:54:55Z",
  "aliases": [
    "CVE-2016-2860"
  ],
  "details": "The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access restrictions and create arbitrary groups as administrators by leveraging mishandling of the creator ID.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
    }
  ],
  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2860"
    },
    {
      "type": "WEB",
      "url": "https://lists.openafs.org/pipermail/openafs-announce/2016/000496.html"
    },
    {
      "type": "WEB",
      "url": "https://www.openafs.org/dl/openafs/1.6.17/RELNOTES-1.6.17"
    },
    {
      "type": "WEB",
      "url": "http://git.openafs.org/?p=openafs.git%3Ba=commitdiff%3Bh=396240cf070a806b91fea81131d034e1399af1e0"
    },
    {
      "type": "WEB",
      "url": "http://git.openafs.org/?p=openafs.git;a=commitdiff;h=396240cf070a806b91fea81131d034e1399af1e0"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2016/dsa-3569"
    },
    {
      "type": "WEB",
      "url": "http://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-05-13T16:59:00Z"
  }
}