PT-2017-8499 · Pivotal · Uaa Bosh+4

Published 2017-04-11 · Updated 2021-08-06 · CVE-2016-4468

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry (PCF) versions before 238 UAA versions 2.x before 2.7.4.4 UAA versions 3.x before 3.3.0.2 UAA versions 3.4.x before 3.4.1 UAA BOSH versions before 11.2 UAA BOSH versions 12.x before 12.2 Elastic Runtime versions before 1.6.29 Elastic Runtime versions 1.7.x before 1.7.7 Ops Manager versions 1.7.x before 1.7.8

Description The issue allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Recommendations For Pivotal Cloud Foundry (PCF) versions before 238, update to version 238 or later. For UAA versions 2.x before 2.7.4.4, update to version 2.7.4.4 or later. For UAA versions 3.x before 3.3.0.2, update to version 3.3.0.2 or later. For UAA versions 3.4.x before 3.4.1, update to version 3.4.1 or later. For UAA BOSH versions before 11.2, update to version 11.2 or later. For UAA BOSH versions 12.x before 12.2, update to version 12.2 or later. For Elastic Runtime versions before 1.6.29, update to version 1.6.29 or later. For Elastic Runtime versions 1.7.x before 1.7.7, update to version 1.7.7 or later. For Ops Manager versions 1.7.x before 1.7.8, update to version 1.7.8 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2016-4468

Affected Products

Runtime

Ops Manager

Pivotal Cloud Foundry

Uaa

Uaa Bosh

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-4468 · Security Note
• https://osv.dev/vulnerability/CVE-2016-4468 · Vendor Advisory
• https://pivotal.io/security/cve-2016-4468 · Vendor Advisory
• https://lists.cloudfoundry.org/archives/list/cf-dev%40lists.cloudfoundry.org/thread/WMTZBIH5U7DTOOX2SNRVTPQI3U2AINOB · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4468 · Note
• https://t.me/cvenotify/18769 · Telegram Post