CVE-2016-4435

Critical

Published: 25/05/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

CVE-2016-4435 affects an endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6 and 3146.13. It allows unauthenticated clients to read or write blobs and may lead to a denial of service attack on the Director VM.

Risk Assessment

The risk to the organization includes unauthorized access to data and potential disruption of system operations, which may result in downtime.

Recommendation

It is recommended to upgrade to stemcell versions 3232.6 or 3146.13 to mitigate this vulnerability and implement additional authentication mechanisms for endpoints.

Original NVD description (English source)

An endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6 and 3146.13 may allow unauthenticated clients to read or write blobs or cause a denial of service attack on the Director VM. This vulnerability requires that the unauthenticated clients guess or find a URL matching an existing GUID.