CVE-2016-0896

High

Published: 18/09/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places the 169.254.0.0/16 address in the all_open Application Security Group, which might allow remote attackers to bypass intended network-connectivity restrictions.

Risk Assessment

Attackers may leverage access to the 169.254.169.254 address, posing a risk of unauthorized access to the organization's network resources.

Recommendation

It is recommended to update Pivotal Cloud Foundry to the latest version to mitigate this vulnerability and review the application security group configurations.

Other vulnerabilities in Pivotal Cloud Foundry Elastic Runtime

CVE-2016-6657High
An open redirect vulnerability has been detected in some Pivotal Cloud Foundry Elastic Runtime components. Users of affected versions should upgrade their software to the specified versions.

Original NVD description (English source)

Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places 169.254.0.0/16 in the all_open Application Security Group, which might allow remote attackers to bypass intended network-connectivity restrictions by leveraging access to the 169.254.169.254 address.