CVE-2016-6651

High

Published: 30/09/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before version 243 and various versions of UAA and Elastic Runtime allows remote authenticated users to gain privileges by leveraging possession of a token.

Risk Assessment

Organizations may be exposed to unauthorized access to resources, potentially leading to serious security breaches.

Recommendation

It is recommended to upgrade to the latest versions of Pivotal Cloud Foundry and UAA to mitigate this vulnerability.

Other vulnerabilities in Pivotal Cloud Foundry, UAA, Elastic Runtime, Ops Manager

CVE-2016-6637Critical
Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before version 242 and in UAA, Elastic Runtime, and Ops Manager allow remote attackers to hijack the authentication of unspecified victims for requests that approve or deny a scope.

Original NVD description (English source)

The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before 12.6; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops Manager 1.7.x before 1.7.13 and 1.8.x before 1.8.1 allows remote authenticated users to gain privileges by leveraging possession of a token.