CVE-2016-0883

Critical

Published: 18/09/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Pivotal Cloud Foundry (PCF) Ops Manager before version 1.5.14 and 1.6.x before version 1.6.9 uses the same cookie-encryption key across different customers' installations, allowing remote attackers to bypass session authentication.

Risk Assessment

Attackers can leverage knowledge of the encryption key from another installation, posing a risk of unauthorized access to user sessions.

Recommendation

It is recommended to upgrade to the latest version of Pivotal Cloud Foundry Ops Manager to ensure unique cookie encryption keys for each installation.

Original NVD description (English source)

Pivotal Cloud Foundry (PCF) Ops Manager before 1.5.14 and 1.6.x before 1.6.9 uses the same cookie-encryption key across different customers' installations, which allows remote attackers to bypass session authentication by leveraging knowledge of this key from another installation.