PT-2018-4624 · Cloud Foundry+1 · Cloud Foundry+1

Publicado 2018-07-11 · Atualizado 2018-09-11 · CVE-2016-0708

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cloud Foundry versions v166 through v227

Description The issue allows for remote disclosure of information, including environment variables and bound service details, in applications deployed to Cloud Foundry. This affects applications that were staged using automatic buildpack detection, passed through the Java Buildpack detection script, and allow the serving of static content from within the deployed artifact. Specifically, the default Apache Tomcat configuration in the affected Java buildpack versions for some basic web application archive (WAR) packaged applications is vulnerable to this issue.

Recommendations For Cloud Foundry versions v166 through v227, to resolve the issue, ensure that applications are not staged using automatic buildpack detection or restrict the serving of static content from within the deployed artifact. Additionally, consider reconfiguring the Apache Tomcat settings to prevent the disclosure of sensitive information.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-0708

Produtos afetados

Apache Tomcat

Cloud Foundry

Referências · 3

• https://cloudfoundry.org/blog/cve-2016-0708 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-0708 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0708 · Nota de Segurança