CVE-2016-4468

High

Published: 11/04/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

An SQL injection vulnerability exists in Pivotal Cloud Foundry (PCF) before version 238 and in UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1. This allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Risk Assessment

This vulnerability may lead to unauthorized access to data and potential deletion or modification of database records. Organizations should be aware of the data security risks involved.

Recommendation

It is recommended to upgrade to the latest versions of Pivotal Cloud Foundry and UAA to mitigate the risks associated with this vulnerability. A security audit of applications using these components should also be conducted.

Other vulnerabilities in Pivotal Cloud Foundry, UAA

CVE-2016-0732High
The identity zones feature in Pivotal Cloud Foundry and UAA allows remote authenticated users with privileges in one zone to gain privileges and perform operations in a different zone. The issue affects versions 208 through 229 and 2.0.0 through 2.7.3 and 3.0.0 UAA.

Original NVD description (English source)

SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before 12.2; Elastic Runtime before 1.6.29 and 1.7.x before 1.7.7; and Ops Manager 1.7.x before 1.7.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.