cnvd - cnvd-2016-10776

cnvd-2016-10776

Vulnerability from cnvd

Title: 多款Pivotal产品重定向漏洞

Description:

Pivotal Cloud Foundry是美国Pivotal Software公司的一套开源的平台即服务（PaaS）云计算平台。

多款Pivotal产品存在重定向漏洞，攻击者可利用漏洞通过构造一个精心制作的URL，当用户点击连接后，可被重定向到攻击者控制的一个网站。

Severity: 中

Patch Name: 多款Pivotal产品重定向漏洞的补丁

Patch Description:

Pivotal Cloud Foundry是美国Pivotal Software公司的一套开源的平台即服务（PaaS）云计算平台。

多款Pivotal产品存在重定向漏洞，攻击者可利用漏洞通过构造一个精心制作的URL，当用户点击连接后，可被重定向到攻击者控制的一个网站。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

用户可联系供应商获得补丁信息： https://pivotal.io/platform

Reference: http://www.securityfocus.com/bid/94126

Impacted products

Name
['Pivotal Software Cloud Foundry Elastic Runtime 1.8.，<1.8.12', 'Pivotal Software Cloud Foundry Ops Manager 1.7.，<1.7.18', 'Pivotal Software Cloud Foundry Ops Manager 1.8.*，<1.8.10']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "94126"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-6657"
    }
  },
  "description": "Pivotal Cloud Foundry\u662f\u7f8e\u56fdPivotal Software\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684\u5e73\u53f0\u5373\u670d\u52a1\uff08PaaS\uff09\u4e91\u8ba1\u7b97\u5e73\u53f0\u3002\r\n\r\n\u591a\u6b3ePivotal\u4ea7\u54c1\u5b58\u5728\u91cd\u5b9a\u5411\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u901a\u8fc7\u6784\u9020\u4e00\u4e2a\u7cbe\u5fc3\u5236\u4f5c\u7684URL\uff0c\u5f53\u7528\u6237\u70b9\u51fb\u8fde\u63a5\u540e\uff0c\u53ef\u88ab\u91cd\u5b9a\u5411\u5230\u653b\u51fb\u8005\u63a7\u5236\u7684\u4e00\u4e2a\u7f51\u7ad9\u3002",
  "discovererName": "Lenu Galardi.",
  "formalWay": "\u7528\u6237\u53ef\u8054\u7cfb\u4f9b\u5e94\u5546\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://pivotal.io/platform",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-10776",
  "openTime": "2016-11-09",
  "patchDescription": "Pivotal Cloud Foundry\u662f\u7f8e\u56fdPivotal Software\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684\u5e73\u53f0\u5373\u670d\u52a1\uff08PaaS\uff09\u4e91\u8ba1\u7b97\u5e73\u53f0\u3002\r\n\r\n\u591a\u6b3ePivotal\u4ea7\u54c1\u5b58\u5728\u91cd\u5b9a\u5411\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u901a\u8fc7\u6784\u9020\u4e00\u4e2a\u7cbe\u5fc3\u5236\u4f5c\u7684URL\uff0c\u5f53\u7528\u6237\u70b9\u51fb\u8fde\u63a5\u540e\uff0c\u53ef\u88ab\u91cd\u5b9a\u5411\u5230\u653b\u51fb\u8005\u63a7\u5236\u7684\u4e00\u4e2a\u7f51\u7ad9\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3ePivotal\u4ea7\u54c1\u91cd\u5b9a\u5411\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Pivotal Software Cloud Foundry Elastic Runtime 1.8.*\uff0c\u003c1.8.12",
      "Pivotal Software Cloud Foundry Ops Manager 1.7.*\uff0c\u003c1.7.18",
      "Pivotal Software Cloud Foundry Ops Manager 1.8.*\uff0c\u003c1.8.10"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/94126",
  "serverity": "\u4e2d",
  "submitTime": "2016-11-08",
  "title": "\u591a\u6b3ePivotal\u4ea7\u54c1\u91cd\u5b9a\u5411\u6f0f\u6d1e"
}

CVE-2016-6657 (GCVE-0-2016-6657)

Vulnerability from cvelistv5

Published

2016-12-16 09:02

Modified

2024-08-06 01:36

Severity ?

CWE

Open redirect vulnerability

Summary

An open redirect vulnerability has been detected with some Pivotal Cloud Foundry Elastic Runtime components. Users of affected versions should apply the following mitigation: Upgrade PCF Elastic Runtime 1.8.x versions to 1.8.12 or later. Upgrade PCF Ops Manager 1.7.x versions to 1.7.18 or later and 1.8.x versions to 1.8.10 or later.

References

▼	URL	Tags
	https://pivotal.io/security/cve-2016-6657	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/94126	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	n/a	PCF Elastic Runtime 1.8.x versions prior to 1.8.12 and PCF Ops Manager 1.7.x versions prior to 1.7.18 and 1.8.x versions prior to 1.8.10	Version: PCF Elastic Runtime 1.8.x versions prior to 1.8.12 and PCF Ops Manager 1.7.x versions prior to 1.7.18 and 1.8.x versions prior to 1.8.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:36:29.434Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://pivotal.io/security/cve-2016-6657"
          },
          {
            "name": "94126",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94126"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PCF Elastic Runtime 1.8.x versions prior to 1.8.12 and PCF Ops Manager 1.7.x versions prior to 1.7.18 and 1.8.x versions prior to 1.8.10",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "PCF Elastic Runtime 1.8.x versions prior to 1.8.12 and PCF Ops Manager 1.7.x versions prior to 1.7.18 and 1.8.x versions prior to 1.8.10"
            }
          ]
        }
      ],
      "datePublic": "2016-12-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An open redirect vulnerability has been detected with some Pivotal Cloud Foundry Elastic Runtime components. Users of affected versions should apply the following mitigation: Upgrade PCF Elastic Runtime 1.8.x versions to 1.8.12 or later. Upgrade PCF Ops Manager 1.7.x versions to 1.7.18 or later and 1.8.x versions to 1.8.10 or later."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Open redirect vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-16T10:57:01",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://pivotal.io/security/cve-2016-6657"
        },
        {
          "name": "94126",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94126"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security_alert@emc.com",
          "ID": "CVE-2016-6657",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PCF Elastic Runtime 1.8.x versions prior to 1.8.12 and PCF Ops Manager 1.7.x versions prior to 1.7.18 and 1.8.x versions prior to 1.8.10",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "PCF Elastic Runtime 1.8.x versions prior to 1.8.12 and PCF Ops Manager 1.7.x versions prior to 1.7.18 and 1.8.x versions prior to 1.8.10"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An open redirect vulnerability has been detected with some Pivotal Cloud Foundry Elastic Runtime components. Users of affected versions should apply the following mitigation: Upgrade PCF Elastic Runtime 1.8.x versions to 1.8.12 or later. Upgrade PCF Ops Manager 1.7.x versions to 1.7.18 or later and 1.8.x versions to 1.8.10 or later."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Open redirect vulnerability"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://pivotal.io/security/cve-2016-6657",
              "refsource": "CONFIRM",
              "url": "https://pivotal.io/security/cve-2016-6657"
            },
            {
              "name": "94126",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94126"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2016-6657",
    "datePublished": "2016-12-16T09:02:00",
    "dateReserved": "2016-08-10T00:00:00",
    "dateUpdated": "2024-08-06T01:36:29.434Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted