CVE-2016-6637

Critical

Published: 30/09/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before version 242 and in UAA, Elastic Runtime, and Ops Manager allow remote attackers to hijack the authentication of unspecified victims for requests that approve or deny a scope.

Risk Assessment

Attackers can exploit these vulnerabilities to take over user sessions, potentially leading to unauthorized access to resources and data within the system.

Recommendation

It is recommended to update Pivotal Cloud Foundry and related components to the latest versions to mitigate the risks associated with these vulnerabilities.

Original NVD description (English source)

Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops Manager 1.7.x before 1.7.13 and 1.8.x before 1.8.1 allow remote attackers to hijack the authentication of unspecified victims for requests that approve or deny a scope via a profile or authorize approval page.