Critical severity · published Sep 30, 2016
CVE-2016-6637
Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH…
9.6
CVSS
0.7%
EPSS
No
On KEV
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops Manager 1.7.x before 1.7.13 and 1.8.x before 1.8.1 allow remote attackers to hijack the authentication of unspecified victims for requests that approve or deny a scope via a profile or authorize approval page.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cloud Foundry · Pivotal Software
through 241 · source: NVD
CF
Cloud Foundry Elastic Runtime · Pivotal Software
1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +34 more · source: NVD
CF
Cloud Foundry Ops Manager · Pivotal Software
1.7.0; 1.7.1; 1.7.2; 1.7.3; 1.7.4; 1.7.5; +8 more · source: NVD
CF
Cloud Foundry Uaa · Pivotal Software
2.3.0; 2.3.1; 2.4.0; 2.5.1; 2.6.1; 2.7.0.2; +15 more · source: NVD
CF
Cloud Foundry Uaa Bosh · Cloudfoundry
through 15.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-6637
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-6637
www.securityfocus.com
http://www.securityfocus.com/bid/93245
Vendor Advisory
https://pivotal.io/security/cve-2016-6637
More from Cloud Foundry Uaa Bosh
9.8
CVE-2017-4992
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior to v2.7.4.17, 3.6.x versions prior to v3.6.11, 3.9.x versions…
8.8
CVE-2017-4973
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions…
8.8
CVE-2016-4468
SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before…
8.8
CVE-2016-6651
The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before…
8.1
CVE-2016-3084
The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier…