Auth bypass in Cloudfoundry Cloud_foundry_uaa_bosh
CVE-2016-6659
Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release (aka uaa-release) before 13.9 for UAA 3.6.5 and before 24 for UAA 3.9.3 allow attackers to gain privileges by a…
Vulnerability class: Broken Authentication
EPSS: 0.003 (55.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Cloudfoundry Cloud_foundry_uaa_bosh
- Pivotal_software Cloud_foundry
- Pivotal_software Cloud_foundry_uaa
- N/a Cloud Foundry V247 And Earlier Uaa V3.9.2 & Bosh (Uaa-release) V23 — versions Cloud Foundry v247 and earlier and UAA v3.9.2 & earlier and UAA bosh (uaa-release) v23 & earlier
Weakness classification (CWE)
References
- security_alert@emc.com (x_refsource_CONFIRM, Vendor Advisory)
- 95085 (vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2016-6659?
- CVE-2016-6659 is a high-severity vulnerability in Cloudfoundry Cloud_foundry_uaa_bosh, classified under Improper Authentication. CVSS score: 8.1/10. Published 2016-12-23.
- How severe is CVE-2016-6659?
- High severity. CVSS v3 base score is 8.1 out of 10.