Token Privilege Escalation in Pivotal Cloud Foundry by Remote Authenticated Users
CVE-2016-6651

8.8HIGH

Key Information:

Vendor

Pivotal Software

Status
Cloud Foundry Uaa
Cloud Foundry Elastic Runtime
Cloud Foundry Ops Manager
Cloud Foundry
Vendor
CVE Published:
30 September 2016

What is CVE-2016-6651?

The vulnerability in Pivotal Cloud Foundry allows remote authenticated users to exploit a flaw in the UAA /oauth/token endpoint. By leveraging a valid token, an attacker can gain unauthorized privileges, circumventing usual access controls. This puts sensitive data and server integrity at risk, highlighting the importance of timely updates and security patches.

References

http://www.securityfocus.com/bid/93241
vdb-entryx_refsource_BID
https://pivotal.io/security/cve-2016-6651
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.