CVE-2016-0732

High

Published: 07/09/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The identity zones feature in Pivotal Cloud Foundry and UAA allows remote authenticated users with privileges in one zone to gain privileges and perform operations in a different zone. The issue affects versions 208 through 229 and 2.0.0 through 2.7.3 and 3.0.0 UAA.

Risk Assessment

The organization may be exposed to unauthorized access to data and operations across different identity zones, potentially leading to serious security breaches.

Recommendation

It is recommended to upgrade to the latest version of Pivotal Cloud Foundry and UAA to mitigate the risks associated with this vulnerability.

Other vulnerabilities in Pivotal Cloud Foundry, UAA

CVE-2016-4468High
An SQL injection vulnerability exists in Pivotal Cloud Foundry (PCF) before version 238 and in UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1. This allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Original NVD description (English source)

The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0 through 1.6.13 allows remote authenticated users with privileges in one zone to gain privileges and perform operations on a different zone via unspecified vectors.