Multiple CSRF Vulnerabilities in Pivotal Cloud Foundry and Related Products
CVE-2016-6637

9.6CRITICAL

Key Information:

Vendor: Pivotal Software
Status: Cloud Foundry Elastic Runtime; Cloud Foundry Uaa; Cloud Foundry Ops Manager; Cloud Foundry
Vendor: CVE Published:; 30 September 2016

🔔 Create Pivotal Software Vulnerability Alert

What is CVE-2016-6637?

Multiple cross-site request forgery (CSRF) vulnerabilities exist in Pivotal Cloud Foundry and its related components. These weaknesses allow remote attackers to hijack the authentication of unspecified users, enabling unauthorized actions on behalf of victims. Users of Pivotal Cloud Foundry, UAA, Elastic Runtime, and Ops Manager prior to specified versions are particularly at risk, as successful exploitation could lead to significant security breaches.

References

http://www.securityfocus.com/bid/93245

vdb-entryx_refsource_BID

https://pivotal.io/security/cve-2016-6637

x_refsource_CONFIRM

CVSS V3.1

Score:

9.6

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 30, 2016
Vulnerability Reserved
Aug 10, 2016

CVE-2016-6637 Data

JSON