Information disclosure in Cloud Foundry
CVE-2016-0708
Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but not limited to environment variables and bound service details. For applications to be vulnerable, they must have been staged using automatic buildpack detection, passed through the Java Buildpack detection script, and allow the serving of static content from within the deployed artifact. The default Apache Tomcat configuration in the affected java buildpack versions for some basic web application archive (WAR) packaged applications are vulnerable to this issue.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.016 (74.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 74th percentile — 74.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.016 · newest: 0.016 · change: 0.000
Affected products
- Cloud Foundry — versions versions v166 through v227
- Cloudfoundry Cf-Release
- Cloudfoundry Java Buildpack
Weakness classification (CWE)
References
- www.cloudfoundry.org/blog/cve-2016-0708/ (Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2016-0708?
- CVE-2016-0708 is a medium-severity vulnerability in Cloud Foundry, classified under Information Disclosure. CVSS score: 5.9/10. Published 2018-07-11.
- How severe is CVE-2016-0708?
- Medium severity. CVSS v3 base score is 5.9 out of 10.