Skip to main content

Cloud Foundry Elastic Runtime CVE-2016-0896

HIGH
7PK - Security Features (CWE-254)
2016-09-18 security_alert@emc.com
Elastic Authentication Bypass Cloud Foundry Elastic Runtime
7.3
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
7.3 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

1
CVE Published
Sep 18, 2016 - 02:59 cve.org
HIGH 7.3

DescriptionCVE.org

Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places 169.254.0.0/16 in the all_open Application Security Group, which might allow remote attackers to bypass intended network-connectivity restrictions by leveraging access to the 169.254.169.254 address.

AnalysisAI

Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places 169.254.0.0/16 in the all_open Application Security Group, which might allow remote attackers to bypass. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-254. Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places 169.254.0.0/16 in the all_open Application Security Group, which might allow remote attackers to bypass intended network-connectivity restrictions by leveraging access to the 169.254.169.254 address. Affected products include: Pivotal Software Cloud Foundry Elastic Runtime. Version information: before 1.6.34.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Cloud Foundry Elastic Runtime

View all
CVE-2017-2773 CRITICAL
9.8 Jun 13

An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.60, 1.7.x versions prior to 1.7.41, 1
CVE-2016-0761 CRITICAL
9.8 May 25

Cloud Foundry Garden-Linux versions prior to v0.333.0 and Elastic Runtime 1.6.x version prior to 1.6.17 contain a flaw i
CVE-2015-5171 CRITICAL
9.8 Oct 24

The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Fo
CVE-2017-4955 CRITICAL
9.8 Jun 13

An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.65, 1.7.x versions prior to 1.7.48, 1
CVE-2015-5172 CRITICAL
9.8 Oct 24

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.
CVE-2016-5006 CRITICAL
9.8 May 02

The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers

CVE-2016-6637 CRITICAL
9.6 Sep 30

Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7
CVE-2016-4468 HIGH
8.8 Apr 11

SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3
CVE-2016-6651 HIGH
8.8 Sep 30

The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and
CVE-2017-4959 HIGH
8.8 Jun 13

An issue was discovered in Pivotal PCF Elastic Runtime 1.8.x versions prior to 1.8.29 and 1.9.x versions prior to 1.9.7.
CVE-2015-5173 HIGH
8.8 Oct 24

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.
CVE-2015-5170 HIGH
8.8 Oct 24

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.

Same weakness CWE-254 – 7PK - Security Features

View all
CVE-2015-1158 CRITICAL POC
10.0
CVE-2016-2296 CRITICAL POC
9.4
CVE-2016-2118 HIGH POC
7.5
CVE-2015-1793 MEDIUM POC
6.5
CVE-2015-3693 CRITICAL POC
9.3
CVE-2016-0128 MEDIUM
6.8
CVE-2016-10178 CRITICAL POC
9.8
CVE-2015-8286 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2016-0896 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy