Open Redirect Vulnerability in Pivotal Cloud Foundry Elastic Runtime
CVE-2016-6657

7.4HIGH

Key Information:

Vendor

Pivotal Software

Status
Pcf Elastic Runtime 1.8.x Versions Prior To 1.8.12 And Pcf Ops Manager 1.7.x Versions Prior To 1.7.18 And 1.8.x Versions Prior To 1.8.10
Vendor
CVE Published:
16 December 2016

What is CVE-2016-6657?

An open redirect vulnerability exists in certain components of Pivotal Cloud Foundry Elastic Runtime. This flaw allows attackers to redirect users to untrusted sites, potentially leading to phishing attacks. Users are strongly encouraged to upgrade their PCF Elastic Runtime to version 1.8.12 or later, and PCF Ops Manager to version 1.7.18 or later for 1.7.x versions and 1.8.10 or later for 1.8.x versions to mitigate the risk associated with this vulnerability.

Affected Version(s)

PCF Elastic Runtime 1.8.x prior to 1.8.12 and PCF Ops Manager 1.7.x prior to 1.7.18 and 1.8.x prior to 1.8.10 PCF Elastic Runtime 1.8.x versions prior to 1.8.12 and PCF Ops Manager 1.7.x versions prior to 1.7.18 and 1.8.x versions prior to 1.8.10

References

https://pivotal.io/security/cve-2016-6657
x_refsource_CONFIRM
http://www.securityfocus.com/bid/94126
vdb-entryx_refsource_BID

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.