{"schemaVersion":3,"id":"CVE-2016-0904","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 use the same encryption key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms and obtain sensitive client-server traffic information by leveraging knowledge of this key from another installation.","dates":{"published":"2016-09-21T01:00:00.000Z","modified":"2024-08-05T22:38:41.258Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.6,"severity":"high","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":8.6,"severity":"high","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":5,"severity":"medium","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01431,"percentile":0.72682,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.01431},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01481,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01431,"percentile":0.72682}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01481,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01431,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01431,"percentile":0.72682}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/200.html"},{"id":"CWE-310","name":"Cryptographic Issues","description":"Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.","type":"category","status":"Draft","abstraction":null,"likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/310.html"}],"affected":[{"vendor":"emc","product":"avamar_server","name":"avamar server","label":"avamar_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 7.3.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 7.3.0","eol":null,"hubHref":"/vendor/emc/avamar_server"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://seclists.org/bugtraq/2016/Sep/31","label":"seclists.org/bugtraq/2016/Sep/31","hostname":"seclists.org","tags":["Mailing List","X Refsource BUGTRAQ","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/93026","label":"www.securityfocus.com/bid/93026","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"http://www.securitytracker.com/id/1036844","label":"www.securitytracker.com/id/1036844","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2016-09-21T01:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-05T22:38:41.258Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":35,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T14:42:50.764Z","stale":false,"partial":false}}