Lucene search

RedhatCVE-2016-0715

HistorySep 11, 2018 - 5:29 p.m.

CVE-2016-0715

2018-09-1117:29:00

CWE-200

redhat

web.nvd.nist.gov

cve-2016-0715

pivotal cloud foundry

elastic runtime

remote information disclosure

vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

5.5

Confidence

High

EPSS

0.002

Percentile

60.7%

JSON

Pivotal Cloud Foundry Elastic Runtime version 1.4.0 through 1.4.5, 1.5.0 through 1.5.11 and 1.6.0 through 1.6.11 is vulnerable to a remote information disclosure. It was found that original mitigation configuration instructions provided as part of CVE-2016-0708 were incomplete and could leave PHP Buildpack, Staticfile Buildpack and potentially other custom Buildpack applications vulnerable to remote information disclosure. Affected applications use automated buildpack detection, serve files directly from the root of the application and have a buildpack that matched after the Java Buildpack in the system buildpack priority when Java Buildpack versions 2.0 through 3.4 were present.

Affected configurations

Nvd

Vulners

Node

pivotal_softwarecloud_foundry_elastic_runtimeRange1.4.0–1.4.5

Node

pivotal_softwarecloud_foundry_elastic_runtimeRange1.5.0–1.5.11

Node

pivotal_softwarecloud_foundry_elastic_runtimeRange1.6.0–1.6.11

VendorProductVersionCPE
pivotal_softwarecloud_foundry_elastic_runtime*cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pivotal_software	cloud_foundry_elastic_runtime	*	cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime::::::::

CNA Affected

[
  {
    "product": "Pivotal Cloud Foundry Elastic Runtime",
    "vendor": "Pivotal",
    "versions": [
      {
        "status": "affected",
        "version": "1.4.0 through 1.4.5"
      },
      {
        "status": "affected",
        "version": "1.5.0 through 1.5.11"
      },
      {
        "status": "affected",
        "version": "1.6.0 through 1.6.11"
      }
    ]
  }
]

References

pivotal.io/security/cve-2016-0715

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

5.5

Confidence

High

EPSS

0.002

Percentile

60.7%

JSON

Related for CVE-2016-0715