CVE-2016-0896 Security feature bypass in n/a
Attackers can bypass network restrictions in Pivotal Cloud Foundry by accessing the metadata service due to overly permissive security group rules.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-0896?
CVE-2016-0896 is a high-severity vulnerability in n/a, published on 18 Sep 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places 169.254.0.0/16 in the all_open Application Security Group, which might allow remote attackers to bypass intended network-connectivity restrictions by leveraging access to the 169.254.169.254 address.
Weakness: CWE-254
Which versions are affected by CVE-2016-0896?
It affects 1 product.
Products include Pivotal Software Cloud Foundry Elastic Runtime.
How do I fix CVE-2016-0896?
No fix has been published for CVE-2016-0896 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-0896 being exploited?
There is no known exploitation of CVE-2016-0896 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2017-2773 Auth bypass in PCF Elastic Runtime
- CVE-2017-4955 Information disclosure in PCF Elastic Runtime
- CVE-2017-4959 Auth bypass in PCF Elastic Runtime
- CVE-2016-6657 Open redirect in PCF Elastic Runtime 1.8.x versions prior to 1.8.12 and PCF Ops Manager 1.7.x versions prior to 1.7.18 and 1.8.x versions prior to 1.8.10
- CVE-2016-0926 Cross-site scripting in n/a
Sources
Also known as GHSA-crwx-2x7c-cgpf.