CVE-2016-9877

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT MQ Telemetry Transport connection authentication with a username/password pair succeeds if an existing username is provid...

CVE-2016-9877

CVE-2016-9877 affects Pivotal RabbitMQ 3.x (before 3.5.8) and 3.6.x (before 3.6.6), and RabbitMQ for PCF 1.5.x (before 1.5.20), 1.6.x (before 1.6.12), and 1.7.x (before 1.7.7). The issue allows MQTT authentication to succeed when a username is provided but the password is omitted from the connect...

CVE-2016-9877

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT MQ Telemetry Transport connection authentication with a username/password pair succeeds if an existing username is provid...

CVE-2016-9877

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT MQ Telemetry Transport connection authentication with a username/password pair succeeds if an existing username is provid...

CVE-2016-9877

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT MQ Telemetry Transport connection authentication with a username/password pair succeeds if an existing username is provid...

Pivotal Software RabbitMQ and RabbitMQ for PCF Security Bypass Vulnerability

Pivotal Software RabbitMQ and RabbitMQ for PCF are both products of the American company Pivotal Software. The former is a set of open source message broker software that implements the Advanced Message Queuing Protocol AMQP, and the latter is an open source messaging server used to support data...

CVE-2016-6657

CVE-2016-6657 describes an open redirect vulnerability affecting some Pivotal Cloud Foundry Elastic Runtime components. The mitigation specifies upgrading to: PCF Elastic Runtime 1.8.12 or later; PCF Ops Manager 1.7.18 or later (and 1.8.x to 1.8.10 or later). Connected documents corroborate the s...

CVE-2016-6651

CVE-2016-6651 affects the UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF), including PCF prior to v243 and UAA releases up to specific versions (UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before 12.6; Elastic Runtime and Ops Manager acro...

CVE-2016-6636

CVE-2016-6636 affects Pivotal Cloud Foundry components and related UAA releases. The vulnerability arises from improper validation of redirect_uri subdomains in the OAuth authorization flow, enabling a remote attacker to obtain implicit access tokens by using a modified subdomain. Affected softwa...

CVE-2016-6637

CVE-2016-6637 involves multiple CSRF vulnerabilities in Pivotal Cloud Foundry (PCF) and related components. The Cloud Foundry release v241 and earlier, UAA releases v2.0.0–v2.7.4.6 and v3.0.0–v3.6.0, and UAA bosh releases up to v15 are affected. The flaw arises because the profile and authorize a...

Design/Logic Flaw

The metrics-collection component in RabbitMQ for Pivotal Cloud Foundry PCF 1.6.x before 1.6.4 logs command lines of failed commands, which might allow context-dependent attackers to obtain sensitive information by reading the log data, as demonstrated by a syslog message that contains credentials...

Authentication flaw

Pivotal Cloud Foundry PCF Ops Manager before 1.5.14 and 1.6.x before 1.6.9 uses the same cookie-encryption key across different customers' installations, which allows remote attackers to bypass session authentication by leveraging knowledge of this key from another installation...

CVE-2016-0883

Pivotal Cloud Foundry PCF Ops Manager before 1.5.14 and 1.6.x before 1.6.9 uses the same cookie-encryption key across different customers' installations, which allows remote attackers to bypass session authentication by leveraging knowledge of this key from another installation...

CVE-2016-0928

The CVE pertains to Pivotal Cloud Foundry Elastic Runtime (PCF) with open redirect vulnerabilities in versions prior to 1.6.30 and 1.7.x before 1.7.8 . The underlying issue is open redirect flaws that allow remote attackers to redirect users to arbitrary external sites, enabling phishing when use...

CVE-2016-0897

CVE-2016-0897 affects Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 and 1.7.x before 1.7.8 when using vCloud or vSphere. The issue is that SSH access for operators is not properly enabled, with unspecified impact and remote attack vectors. The available documents do not provide concrete r...

CVE-2016-0883

CVE-2016-0883 affects Pivotal Cloud Foundry Ops Manager prior to 1.5.14 and 1.6.x prior to 1.6.9. The issue is that the same cookie-encryption key was used across different customers’ installations, enabling remote attackers to bypass session authentication by leveraging knowledge of the key from...

CVE-2016-0896

CVE-2016-0896 affects Pivotal Cloud Foundry Elastic Runtime. The issue occurs when older releases (1.6.x before 1.6.34 and 1.7.x before 1.7.12) place the 169.254.0.0/16 range into the all_open Application Security Group, potentially allowing remote attackers who can access the 169.254.169.254 add...

CVE-2016-0929

What is affected: RabbitMQ for Pivotal Cloud Foundry (PCF) 1.6.x (metrics-collection component) before 1.6.4. Vulnerability details: The metrics-collection component logs command lines of failed commands, which may allow context-dependent attackers to read log data and obtain sensitive informatio...

CVE-2016-0927

The CVE-2016-0927 issue affects Pivotal Cloud Foundry (PCF) Ops Manager, specifically versions before 1.6.17. Descriptions across multiple sources identify a cross-site scripting (XSS) or HTML injection vulnerability that allows remote attackers to inject arbitrary scripts or HTML via unspecified...

CVE-2016-0929

The metrics-collection component in RabbitMQ for Pivotal Cloud Foundry PCF 1.6.x before 1.6.4 logs command lines of failed commands, which might allow context-dependent attackers to obtain sensitive information by reading the log data, as demonstrated by a syslog message that contains credentials...