PT-2018-4966 · Cloud Foundry · Cf-Release

Publicado 2018-03-29 · Atualizado 2018-04-24 · CVE-2016-6658

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions cf-release versions prior to 245

Description The issue allows an operator with privileged access to the Cloud Controller database to view user-provided credentials, such as basic auth or OAuth, used to access custom buildpacks. These credentials can be included in the URL to access the buildpack and are stored unencrypted. For example, a GitHub username and password used to access a private repository could be exposed.

Recommendations For versions prior to 245, consider removing or restricting access to custom buildpacks that use user-provided credentials until a fixed version is available. As a temporary workaround, avoid using credentials in the URL to access buildpacks, and instead, explore alternative authentication methods that do not involve storing sensitive information in plain text.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-6658

Produtos afetados

Cf-Release

Referências · 4

• https://pivotal.io/security/cve-2016-6658 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-6658 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-6658 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6658 · Nota