// For flags

CVE-2016-6659

 

Severity Score

8.1
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release (aka uaa-release) before 13.9 for UAA 3.6.5 and before 24 for UAA 3.9.3 allow attackers to gain privileges by accessing UAA logs and subsequently running a specially crafted application that interacts with a configured SAML provider.

Cloud Foundry en versiones anteriores a 248; UAA 2.x en versiones anteriores a 2.7.4.12, 3.x en versiones anteriores a 3.6.5 y 3.7.x hasta la versión 3.9.x en versiones anteriores a 3.9.3 y UAA bosh release (también conocido como uaa-release) en versiones anteriores a 13.9 para UAA 3.6.5 y en versiones anteriores a 24 para UAA 3.9.3 permite a atacantes remotos obtener privilegios para obtener acceso y acceder a los registros y posteriormete ejecutar una aplicación espcial manipulada que interactua con la configuración SAML del proveedor.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
High
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2016-08-10 CVE Reserved
  • 2016-12-23 CVE Published
  • 2023-03-07 EPSS Updated
  • 2024-08-06 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-287: Improper Authentication
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cloudfoundry
Search vendor "Cloudfoundry"
 Cloud Foundry Uaa Bosh
Search vendor "Cloudfoundry" for product "Cloud Foundry Uaa Bosh"
 <= 23.0
Search vendor "Cloudfoundry" for product "Cloud Foundry Uaa Bosh" and version " <= 23.0"
-
Affected
Pivotal Software
Search vendor "Pivotal Software"
 Cloud Foundry
Search vendor "Pivotal Software" for product "Cloud Foundry"
 <= 247.0
Search vendor "Pivotal Software" for product "Cloud Foundry" and version " <= 247.0"
-
Affected
Pivotal Software
Search vendor "Pivotal Software"
 Cloud Foundry Uaa
Search vendor "Pivotal Software" for product "Cloud Foundry Uaa"
 <= 3.9.2
Search vendor "Pivotal Software" for product "Cloud Foundry Uaa" and version " <= 3.9.2"
-
Affected