PT-2018-4625 · Pivotal · Php Buildpack+3
Publicado
2018-09-11
·
Atualizado
2019-10-09
·
CVE-2016-0715
CVSS v3.1
5.9
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Pivotal Cloud Foundry Elastic Runtime versions 1.4.0 through 1.4.5
Pivotal Cloud Foundry Elastic Runtime versions 1.5.0 through 1.5.11
Pivotal Cloud Foundry Elastic Runtime versions 1.6.0 through 1.6.11
Description
A remote information disclosure issue was found. The original mitigation configuration instructions provided were incomplete, potentially leaving PHP Buildpack, Staticfile Buildpack, and other custom Buildpack applications vulnerable. This issue affects applications that use automated buildpack detection, serve files directly from the root of the application, and have a buildpack that matched after the Java Buildpack in the system buildpack priority when Java Buildpack versions 2.0 through 3.4 were present.
Recommendations
For Pivotal Cloud Foundry Elastic Runtime versions 1.4.0 through 1.4.5, update the configuration to properly mitigate the remote information disclosure issue.
For Pivotal Cloud Foundry Elastic Runtime versions 1.5.0 through 1.5.11, update the configuration to properly mitigate the remote information disclosure issue.
For Pivotal Cloud Foundry Elastic Runtime versions 1.6.0 through 1.6.11, update the configuration to properly mitigate the remote information disclosure issue.
As a temporary workaround, consider restricting the use of automated buildpack detection for affected applications until a proper configuration update is applied.
Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Java Buildpack
Php Buildpack
Pivotal Cloud Foundry (Pcf) Elastic Runtime
Staticfile Buildpack