Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS00bThjLWg3ZnItZ3E1Y83uFw

Cloud Foundry vulnerable to Cross-Site Request Forgery

Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops Manager 1.7.x before 1.7.13 and 1.8.x before 1.8.1 allow remote attackers to hijack the authentication of unspecified victims for requests that approve or deny a scope via a profile or authorize approval page.

Permalink: https://github.com/advisories/GHSA-4m8c-h7fr-gq5c
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00bThjLWg3ZnItZ3E1Y83uFw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 2 years ago
Updated: 2 months ago

CVSS Score: 9.6
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Identifiers: GHSA-4m8c-h7fr-gq5c, CVE-2016-6637
References:

• https://nvd.nist.gov/vuln/detail/CVE-2016-6637
• https://pivotal.io/security/cve-2016-6637
• https://github.com/cloudfoundry/uaa/commit/37e0384c52d3337a3fa4eef6647032229edecfa4
• https://github.com/cloudfoundry/uaa/commit/cded6164a3b90e791688a954069aea3cfde59b69
• https://github.com/cloudfoundry/uaa/commit/f3d8a9e1ee1acac5bf1f8487ac9461f4cf4505c
• https://web.archive.org/web/20200227221542/http://www.securityfocus.com/bid/93245
• https://github.com/advisories/GHSA-4m8c-h7fr-gq5c

Repository: https://github.com/cloudfoundry/uaa
Blast Radius: 11.3

Affected Packages