CVE-2016-0732 The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0...
HighCVSS 8.8
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0 through 1.6.13 allows remote authenticated users with privileges in one zone to gain privileges and perform operations on a different zone via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cloudfoundry cf-release | >= 208, <= 229 | No fix listed |
| cloudfoundry user account and authentication | = 2.0.0 | No fix listed |
| cloudfoundry user account and authentication | = 2.0.1 | No fix listed |
| cloudfoundry user account and authentication | = 2.0.2 | No fix listed |
| cloudfoundry user account and authentication | = 2.0.3 | No fix listed |
| cloudfoundry user account and authentication | = 2.1.0 | No fix listed |
| cloudfoundry user account and authentication | = 2.2.0 | No fix listed |
| cloudfoundry user account and authentication | = 2.2.1 | No fix listed |
| cloudfoundry user account and authentication | = 2.2.2 | No fix listed |
| cloudfoundry user account and authentication | = 2.2.3 | No fix listed |
| cloudfoundry user account and authentication | = 2.2.4 | No fix listed |
| cloudfoundry user account and authentication | = 2.2.4.1 | No fix listed |
| cloudfoundry user account and authentication | = 2.2.5 | No fix listed |
| cloudfoundry user account and authentication | = 2.2.5.2 | No fix listed |
| cloudfoundry user account and authentication | = 2.2.5.3 | No fix listed |
| cloudfoundry user account and authentication | = 2.2.6 | No fix listed |
| cloudfoundry user account and authentication | = 2.3.0 | No fix listed |
| cloudfoundry user account and authentication | = 2.3.1 | No fix listed |
| cloudfoundry user account and authentication | = 2.3.1.1 | No fix listed |
| cloudfoundry user account and authentication | = 2.4.0 | No fix listed |
| cloudfoundry user account and authentication | = 2.4.1 | No fix listed |
| cloudfoundry user account and authentication | = 2.5.0 | No fix listed |
| cloudfoundry user account and authentication | = 2.5.1 | No fix listed |
| cloudfoundry user account and authentication | = 2.5.2 | No fix listed |
| cloudfoundry user account and authentication | = 2.6.0 | No fix listed |
Show 26 more
| Product | Affected versions | Fixed in |
|---|---|---|
| cloudfoundry user account and authentication | = 2.6.1 | No fix listed |
| cloudfoundry user account and authentication | = 2.6.2 | No fix listed |
| cloudfoundry user account and authentication | = 2.7.0 | No fix listed |
| cloudfoundry user account and authentication | = 2.7.0.1 | No fix listed |
| cloudfoundry user account and authentication | = 2.7.0.2 | No fix listed |
| cloudfoundry user account and authentication | = 2.7.0.3 | No fix listed |
| cloudfoundry user account and authentication | = 2.7.1 | No fix listed |
| cloudfoundry user account and authentication | = 2.7.2 | No fix listed |
| cloudfoundry user account and authentication | = 2.7.3 | No fix listed |
| cloudfoundry uaa-release | = 2 | No fix listed |
| cloudfoundry uaa-release | = 3 | No fix listed |
| cloudfoundry uaa-release | = 4 | No fix listed |
| pivotal elastic runtime | = 1.6.0 | No fix listed |
| pivotal elastic runtime | = 1.6.1 | No fix listed |
| pivotal elastic runtime | = 1.6.2 | No fix listed |
| pivotal elastic runtime | = 1.6.3 | No fix listed |
| pivotal elastic runtime | = 1.6.4 | No fix listed |
| pivotal elastic runtime | = 1.6.5 | No fix listed |
| pivotal elastic runtime | = 1.6.6 | No fix listed |
| pivotal elastic runtime | = 1.6.7 | No fix listed |
| pivotal elastic runtime | = 1.6.8 | No fix listed |
| pivotal elastic runtime | = 1.6.9 | No fix listed |
| pivotal elastic runtime | = 1.6.10 | No fix listed |
| pivotal elastic runtime | = 1.6.11 | No fix listed |
| pivotal elastic runtime | = 1.6.12 | No fix listed |
| pivotal elastic runtime | = 1.6.13 | No fix listed |
References
- pivotal.io mitigation vendor-advisory