Critical severity · published May 2, 2017
CVE-2016-5006
The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential information via…
9.8
CVSS
1.1%
EPSS
No
On KEV
Description
The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential information via unspecified vectors.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cloud Foundry · Pivotal Software
through 238.0 · source: NVD
CF
Cloud Foundry Elastic Runtime · Pivotal Software
through 1.6.32; 1.7.0; 1.7.1; 1.7.2; 1.7.3; 1.7.4; +6 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-5006
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-5006
Vendor Advisory
https://pivotal.io/security/cve-2016-5006
Vendor Advisory
https://www.cloudfoundry.org/CVE-2016-5006/
More from Cloud Foundry
9.6
CVE-2016-6637
Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH…
8.8
CVE-2016-4468
SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before…
8.8
CVE-2016-6651
The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before…
8.1
CVE-2016-3084
The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier…
8.1
CVE-2016-6659
Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release (aka uaa-release) before 13.9 for UAA 3.6.5 and…