CVE-2016-0708 Information disclosure in Cloud Foundry

What is CVE-2016-0708?

CVE-2016-0708 is a medium-severity vulnerability in Cloud Foundry, published on 11 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but not limited to environment variables and bound service details. For applications to be vulnerable, they must have been staged using automatic buildpack detection, passed through the Java Buildpack detection script, and allow the serving of static content from within the deployed artifact. The default Apache Tomcat configuration in the affected java buildpack versions for some basic web application archive (WAR) packaged applications are vulnerable to this issue.

Weakness: CWE-200

Which versions are affected by CVE-2016-0708?

It affects 2 products.

Products include Cloudfoundry Cf-Release, Cloudfoundry Java Buildpack.

How do I fix CVE-2016-0708?

No fix has been published for CVE-2016-0708 yet. Limit exposure of the affected software until one is available.

Is CVE-2016-0708 being exploited?

There is no known exploitation of CVE-2016-0708 in the wild and no public exploit code.

Other vulnerabilities in Cloud Foundry

• CVE-2015-5171 Cloud Foundry Runtime Insufficient Session Expiration vulnerability Critical 9.8
• CVE-2015-5172 Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password Critical 9.8
• CVE-2016-8218 Auth bypass in Cloud Foundry Critical 9.8
• CVE-2017-4992 Cloud Foundry UAA privilege escalation with user invitations Critical 9.8
• CVE-2016-6658 Information disclosure in n/a Critical 9.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rr6c-mf52-hvf4.