cbcvebase.
CVE-2016-6651
published 2016-09-30

CVE-2016-6651: The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before…

PriorityP352high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EPSS
1.75%
75.1th percentile
The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before 12.6; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops Manager 1.7.x before 1.7.13 and 1.8.x before 1.8.1 allows remote authenticated users to gain privileges by leveraging possession of a token.

Affected

77 ranges· showing 25
VendorProductVersion rangeFixed in
cloudfoundrycloud_foundry_uaa_bosh<= 16.0—
pivotal_softwarecloud_foundry<= 242.0—
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——
pivotal_softwarecloud_foundry_elastic_runtime——

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.