Lucene search
HistorySep 30, 2016 - 12:59 a.m.
CVE-2016-6637
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
9.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
9.6 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
39.5%
Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops Manager 1.7.x before 1.7.13 and 1.8.x before 1.8.1 allow remote attackers to hijack the authentication of unspecified victims for requests that approve or deny a scope via a profile or authorize approval page.
Affected configurations
Node
cloudfoundrycloud_foundry_uaa_boshRange≤15.0
ORpivotal_softwarecloud_foundryRange≤241
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.0
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.1
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.2
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.3
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.4
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.5
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.6
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.7
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.8
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.9
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.10
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.11
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.12
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.13
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.14
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.15
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.17
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.18
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.19
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.20
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.21
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.22
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.23
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.25
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.26
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.27
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.28
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.29
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.30
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.31
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.32
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.33
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.34
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.35
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.36
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.37
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.38
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.6.39
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.0
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.1
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.2
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.3
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.4
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.5
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.6
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.7
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.8
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.9
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.10
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.11
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.12
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.13
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.14
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.15
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.16
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.17
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.18
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.19
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.7.20
ORpivotal_softwarecloud_foundry_elastic_runtimeMatch1.8.0
ORpivotal_softwarecloud_foundry_ops_managerMatch1.7.0
ORpivotal_softwarecloud_foundry_ops_managerMatch1.7.1
ORpivotal_softwarecloud_foundry_ops_managerMatch1.7.2
ORpivotal_softwarecloud_foundry_ops_managerMatch1.7.3
ORpivotal_softwarecloud_foundry_ops_managerMatch1.7.4
ORpivotal_softwarecloud_foundry_ops_managerMatch1.7.5
ORpivotal_softwarecloud_foundry_ops_managerMatch1.7.6
ORpivotal_softwarecloud_foundry_ops_managerMatch1.7.7
ORpivotal_softwarecloud_foundry_ops_managerMatch1.7.8
ORpivotal_softwarecloud_foundry_ops_managerMatch1.7.9
ORpivotal_softwarecloud_foundry_ops_managerMatch1.7.10
ORpivotal_softwarecloud_foundry_ops_managerMatch1.7.11
ORpivotal_softwarecloud_foundry_ops_managerMatch1.7.12
ORpivotal_softwarecloud_foundry_ops_managerMatch1.8.0
ORpivotal_softwarecloud_foundry_uaaMatch2.3.0
ORpivotal_softwarecloud_foundry_uaaMatch2.3.1
ORpivotal_softwarecloud_foundry_uaaMatch2.4.0
ORpivotal_softwarecloud_foundry_uaaMatch2.5.1
ORpivotal_softwarecloud_foundry_uaaMatch2.6.1
ORpivotal_softwarecloud_foundry_uaaMatch2.7.0.2
ORpivotal_softwarecloud_foundry_uaaMatch2.7.0.3
ORpivotal_softwarecloud_foundry_uaaMatch2.7.1
ORpivotal_softwarecloud_foundry_uaaMatch2.7.2
ORpivotal_softwarecloud_foundry_uaaMatch2.7.3
ORpivotal_softwarecloud_foundry_uaaMatch2.7.4.6
ORpivotal_softwarecloud_foundry_uaaMatch3.0.0
ORpivotal_softwarecloud_foundry_uaaMatch3.0.1
ORpivotal_softwarecloud_foundry_uaaMatch3.1.0
ORpivotal_softwarecloud_foundry_uaaMatch3.2.0
ORpivotal_softwarecloud_foundry_uaaMatch3.2.1
ORpivotal_softwarecloud_foundry_uaaMatch3.3.0
ORpivotal_softwarecloud_foundry_uaaMatch3.3.0.1
ORpivotal_softwarecloud_foundry_uaaMatch3.4.0
ORpivotal_softwarecloud_foundry_uaaMatch3.4.1
ORpivotal_softwarecloud_foundry_uaaMatch3.4.2
Related
cve
cve
CVE-2016-6637
2016-09-30 00:59:01
osv
osv
Cloud Foundry vulnerable to Cross-Site Request Forgery
2022-05-13 01:07:27
cloudfoundry
cloudfoundry
CVE-2016-6637 UAA CSRF Vulnerability for OAuth Approvals | Cloud Foundry
2016-09-26 00:00:00
github
github
Cloud Foundry vulnerable to Cross-Site Request Forgery
2022-05-13 01:07:27
prion
prion
Cross site request forgery (csrf)
2016-09-30 00:59:00
cvelist
cvelist
CVE-2016-6637
2016-09-30 00:00:00
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
9.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
9.6 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
39.5%
Related for NVD:CVE-2016-6637