CVE-2016-6659 Privilege escalation in Cloud Foundry v247 and earlier and UAA v3.9.2 & earlier and UAA bosh (uaa-release) v23 & earlier

What is CVE-2016-6659?

CVE-2016-6659 is a high-severity vulnerability in Cloud Foundry v247 and earlier and UAA v3.9.2 & earlier and UAA bosh (uaa-release) v23 & earlier, published on 23 Dec 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release (aka uaa-release) before 13.9 for UAA 3.6.5 and before 24 for UAA 3.9.3 allow attackers to gain privileges by accessing UAA logs and subsequently running a specially crafted application that interacts with a configured SAML provider.

Weakness: CWE-287

Which versions are affected by CVE-2016-6659?

It affects 3 products.

Products include Cloudfoundry Cloud Foundry Uaa Bosh, Pivotal Software Cloud Foundry, Pivotal Software Cloud Foundry Uaa.

How do I fix CVE-2016-6659?

No fix has been published for CVE-2016-6659 yet. Limit exposure of the affected software until one is available.

Is CVE-2016-6659 being exploited?

There is no known exploitation of CVE-2016-6659 in the wild and no public exploit code.

Other vulnerabilities in Cloud Foundry v247 and earlier and UAA v3.9.2 & earlier and UAA bosh (uaa-release) v23 & earlier

• CVE-2016-6637 Cloud Foundry vulnerable to Cross-Site Request Forgery Critical 9.6
• CVE-2017-4973 Cloud Foundry UAA Privilege Escalation High 8.8
• CVE-2016-4468 SQL injection in n/a High 8.8
• CVE-2016-6651 Privilege escalation in n/a High 8.8
• CVE-2016-3084 Cloud Foundry UAA reset password vulnerable to brute force attack High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8pj8-jjrc-8g8h.