CVE-2016-4435
Severity Score
9.0
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
An endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6 and 3146.13 may allow unauthenticated clients to read or write blobs or cause a denial of service attack on the Director VM. This vulnerability requires that the unauthenticated clients guess or find a URL matching an existing GUID.
Un endpoint del agente que se ejecuta en la máquina virtual BOSH Director con versiones de stemcell anteriores a la 3232.6 y a la 3146.13 puede permitir que clientes no autenticados lean o escriban en blobs o lleven a cabo un ataque de denegación de servicio (DoS) en la máquina virtual Director. Esta vulnerabilidad requiere que el cliente no autenticado adivine o encuentre una URL que coincida con un GUID existente.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2016-05-02 CVE Reserved
- 2017-05-25 CVE Published
- 2024-02-05 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (1)
| URL | Tag | Source |
|---|---|---|
| https://pivotal.io/security/cve-2016-4435 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Pivotal Search vendor "Pivotal" | Bosh Stemcell Search vendor "Pivotal" for product "Bosh Stemcell" | <= 3232.4 Search vendor "Pivotal" for product "Bosh Stemcell" and version " <= 3232.4" | - |
Affected
| ||||||
| Pivotal Search vendor "Pivotal" | Bosh Stemcell Search vendor "Pivotal" for product "Bosh Stemcell" | 3146.13 Search vendor "Pivotal" for product "Bosh Stemcell" and version "3146.13" | - |
Affected
| ||||||