CVE-2016-1587 - CVE House
Back to Database
Status published High CVE-2016-1587

The Snapweb interface before version 0.21.2 was exposing controls to...

Vulnerability Description

The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the user, nor the origin of the connection. An attacker could have used the controls to remotely add a valid, but malicious, snap package, from the Store, potentially using system resources without permission from the legitimate administrator of the system.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-1587

Credits & Attribution

No credits recorded in the NVD database.

References

More from Ubuntu

View All →
CVE-2025-7044
Privilege Escalation in MAAS via Websocket Request Manipulation
High 7.7
CVE-2025-2486
UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu
Low 3.7
CVE-2023-0881
DDoS in Ubuntu package linux-bluefield
High 7.5
CVE-2022-1804
Accountsservice incorrectly drops privileges
Medium 5.5
CVE-2021-3939
Free of static data in accountsservice
High 7.8

Affected Vendor

Affected Software

snapweb
Vulnerable Versions:
unspecified

Timeline

Official Publish: April 22nd, 2019
Last Modified: September 16th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.