What is CVE-2016-0708?

CVE-2016-0708 is a medium-severity vulnerability in Cloud Foundry, classified under Information Disclosure. CVSS score: 5.9/10. Published 2018-07-11.

How severe is CVE-2016-0708?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Information disclosure in Cloud Foundry

CVE-2016-0708

Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but not limited to environment variables and bound service details. For applications to be vulnerable, they must have been staged using automatic buildpack detection, passed through the Java Buildpack detection script, and allow the serving of static content from within the deployed artifact. The default Apache Tomcat configuration in the affected java buildpack versions for some basic web application archive (WAR) packaged applications are vulnerable to this issue.

Vulnerability class: Information Disclosure

EPSS: 0.016 (72.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Cloud Foundry — versions versions v166 through v227
Cloudfoundry Cf-release
Cloudfoundry Java_buildpack

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

security_alert@emc.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2016-0708?: CVE-2016-0708 is a medium-severity vulnerability in Cloud Foundry, classified under Information Disclosure. CVSS score: 5.9/10. Published 2018-07-11.
How severe is CVE-2016-0708?: Medium severity. CVSS v3 base score is 5.9 out of 10.