OAuth Vulnerability in Pivotal Cloud Foundry and UAA Products
CVE-2016-6636

5.3MEDIUM

Key Information:

Vendor: Pivotal Software
Status: Cloud Foundry Elastic Runtime; Cloud Foundry Uaa; Cloud Foundry Ops Manager; Cloud Foundry
Vendor: CVE Published:; 30 September 2016

🔔 Create Pivotal Software Vulnerability Alert

What is CVE-2016-6636?

The OAuth authorization implementation in various versions of Pivotal Cloud Foundry and UAA products improperly handles the redirect_uri subdomains. This misconfiguration enables remote attackers to craft malicious subdomains, potentially allowing them to obtain access tokens unintentionally granted through OAuth processes. It emphasizes the importance of ensuring robust validation and handling of redirect URIs to mitigate risks of unauthorized access and token exposure.

References

http://www.securityfocus.com/bid/93246

vdb-entryx_refsource_BID

https://pivotal.io/security/cve-2016-6636

x_refsource_CONFIRM

CVSS V3.1

Score:

5.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

None

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 30, 2016
Vulnerability Reserved
Aug 10, 2016

CVE-2016-6636 Data

JSON