PT-2016-7012 · Pivotal · Uaa Bosh+4

Published 2016-09-30 · Updated 2022-05-13 · CVE-2016-6637

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry versions prior to 242 UAA versions 2.x prior to 2.7.4.7 UAA versions 3.x prior to 3.3.0.5 UAA versions 3.4.x prior to 3.4.4 UAA BOSH versions prior to 11.5 UAA BOSH versions 12.x prior to 12.5 Elastic Runtime versions 1.6.x prior to 1.6.40 Elastic Runtime versions 1.7.x prior to 1.7.21 Elastic Runtime versions 1.8.x prior to 1.8.2 Ops Manager versions 1.7.x prior to 1.7.13 Ops Manager versions 1.8.x prior to 1.8.1

Description Multiple cross-site request forgery (CSRF) vulnerabilities allow remote attackers to hijack the authentication of unspecified victims for requests that approve or deny a scope via a profile or authorize approval page.

Recommendations For Pivotal Cloud Foundry versions prior to 242, update to version 242 or later. For UAA versions 2.x prior to 2.7.4.7, update to version 2.7.4.7 or later. For UAA versions 3.x prior to 3.3.0.5, update to version 3.3.0.5 or later. For UAA versions 3.4.x prior to 3.4.4, update to version 3.4.4 or later. For UAA BOSH versions prior to 11.5, update to version 11.5 or later. For UAA BOSH versions 12.x prior to 12.5, update to version 12.5 or later. For Elastic Runtime versions 1.6.x prior to 1.6.40, update to version 1.6.40 or later. For Elastic Runtime versions 1.7.x prior to 1.7.21, update to version 1.7.21 or later. For Elastic Runtime versions 1.8.x prior to 1.8.2, update to version 1.8.2 or later. For Ops Manager versions 1.7.x prior to 1.7.13, update to version 1.7.13 or later. For Ops Manager versions 1.8.x prior to 1.8.1, update to version 1.8.1 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2016-6637

GHSA-4M8C-H7FR-GQ5C

Affected Products

Runtime

Ops Manager

Pivotal Cloud Foundry

Uaa

Uaa Bosh

References · 11

• https://osv.dev/vulnerability/GHSA-4m8c-h7fr-gq5c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6637 · Security Note
• https://osv.dev/vulnerability/CVE-2016-6637 · Vendor Advisory
• https://pivotal.io/security/cve-2016-6637 · Vendor Advisory
• https://github.com/cloudfoundry/uaa/commit/37e0384c52d3337a3fa4eef6647032229edecfa4 · Note
• https://github.com/cloudfoundry/uaa/commit/cded6164a3b90e791688a954069aea3cfde59b69 · Note
• https://github.com/cloudfoundry/uaa/commit/f3d8a9e1ee1acac5bf1f8487ac9461f4cf4505c · Note
• https://web.archive.org/web/20200227221542/http://securityfocus.com/bid/93245 · Note
• http://securityfocus.com/bid/93245 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6637 · Note
• https://t.me/cvenotify/18758 · Telegram Post