Lucene search

K
cve[email protected]CVE-2016-6636
HistorySep 30, 2016 - 12:59 a.m.

CVE-2016-6636

2016-09-3000:59:00
CWE-601
web.nvd.nist.gov
25
cve-2016-6636
oauth
pivotal cloud foundry
pcf
uaa
elastic runtime
ops manager
nvd
security vulnerability

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.1 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.6%

The OAuth authorization implementation in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.1; and Ops Manager 1.7.x before 1.7.13 and 1.8.x before 1.8.1 mishandles redirect_uri subdomains, which allows remote attackers to obtain implicit access tokens via a modified subdomain.

Affected configurations

NVD
Node
cloudfoundrycloud_foundry_uaa_boshRange12.3
OR
pivotal_softwarecloud_foundryRange241
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.0
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.1
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.2
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.3
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.4
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.5
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.6
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.7
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.8
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.9
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.10
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.11
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.12
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.13
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.14
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.15
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.17
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.18
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.19
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.20
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.21
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.22
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.23
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.25
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.26
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.27
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.28
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.29
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.30
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.31
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.32
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.33
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.34
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.35
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.36
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.37
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.38
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.39
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.0
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.1
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.2
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.3
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.4
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.5
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.6
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.7
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.8
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.9
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.10
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.11
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.12
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.13
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.14
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.15
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.16
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.17
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.18
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.19
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.20
OR
pivotal_softwarecloud_foundry_elastic_runtimeMatch1.8.0
OR
pivotal_softwarecloud_foundry_ops_managerMatch1.7.0
OR
pivotal_softwarecloud_foundry_ops_managerMatch1.7.1
OR
pivotal_softwarecloud_foundry_ops_managerMatch1.7.2
OR
pivotal_softwarecloud_foundry_ops_managerMatch1.7.3
OR
pivotal_softwarecloud_foundry_ops_managerMatch1.7.4
OR
pivotal_softwarecloud_foundry_ops_managerMatch1.7.5
OR
pivotal_softwarecloud_foundry_ops_managerMatch1.7.6
OR
pivotal_softwarecloud_foundry_ops_managerMatch1.7.7
OR
pivotal_softwarecloud_foundry_ops_managerMatch1.7.8
OR
pivotal_softwarecloud_foundry_ops_managerMatch1.7.9
OR
pivotal_softwarecloud_foundry_ops_managerMatch1.7.10
OR
pivotal_softwarecloud_foundry_ops_managerMatch1.7.11
OR
pivotal_softwarecloud_foundry_ops_managerMatch1.7.12
OR
pivotal_softwarecloud_foundry_ops_managerMatch1.8.0
OR
pivotal_softwarecloud_foundry_uaaMatch2.3.0
OR
pivotal_softwarecloud_foundry_uaaMatch2.3.1
OR
pivotal_softwarecloud_foundry_uaaMatch2.4.0
OR
pivotal_softwarecloud_foundry_uaaMatch2.5.1
OR
pivotal_softwarecloud_foundry_uaaMatch2.6.1
OR
pivotal_softwarecloud_foundry_uaaMatch2.7.0.2
OR
pivotal_softwarecloud_foundry_uaaMatch2.7.0.3
OR
pivotal_softwarecloud_foundry_uaaMatch2.7.1
OR
pivotal_softwarecloud_foundry_uaaMatch2.7.2
OR
pivotal_softwarecloud_foundry_uaaMatch2.7.3
OR
pivotal_softwarecloud_foundry_uaaMatch2.7.4.6
OR
pivotal_softwarecloud_foundry_uaaMatch3.0.0
OR
pivotal_softwarecloud_foundry_uaaMatch3.0.1
OR
pivotal_softwarecloud_foundry_uaaMatch3.1.0
OR
pivotal_softwarecloud_foundry_uaaMatch3.2.0
OR
pivotal_softwarecloud_foundry_uaaMatch3.2.1
OR
pivotal_softwarecloud_foundry_uaaMatch3.3.0
OR
pivotal_softwarecloud_foundry_uaaMatch3.3.0.1
OR
pivotal_softwarecloud_foundry_uaaMatch3.4.0
OR
pivotal_softwarecloud_foundry_uaaMatch3.4.1
OR
pivotal_softwarecloud_foundry_uaaMatch3.4.2

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.1 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.6%

Related for CVE-2016-6636