FKIE_CVE-2016-0732
Vulnerability from fkie_nvd - Published: 2017-09-07 13:29 - Updated: 2026-06-17 00:38
Severity
Summary
The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0 through 1.6.13 allows remote authenticated users with privileges in one zone to gain privileges and perform operations on a different zone via unspecified vectors.
References
| URL | Tags | ||
|---|---|---|---|
| secalert@redhat.com | https://pivotal.io/security/cve-2016-0732 | Mitigation, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://pivotal.io/security/cve-2016-0732 | Mitigation, Vendor Advisory |
Impacted products
{
"affected": [
{
"affectedData": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"source": "secalert@redhat.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cloudfoundry:cf-release:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C6351C26-3E4F-4783-AC20-13076FDFD898",
"versionEndIncluding": "229",
"versionStartIncluding": "208",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8FAB232F-1FA4-4C5E-B302-68065DBA7510",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "44FEA25C-11C6-495C-84B6-EC8EDE0A5250",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D69110C2-044B-4EFE-B947-7E7FF382B110",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "62C001BE-9484-4AC9-9A03-890CD70A5DC4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2B3E5A61-D13E-427F-AD00-F86ECD567318",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "49D09957-D01C-4914-A05F-B5F242DAD261",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "86766366-895E-4AEB-B5B0-E8181109EF39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C0EDADC-A658-4776-91C0-07DF44792356",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BDC9EBE9-D869-4CAF-B4AD-F5F36EA040D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "65E7C154-AB1D-4190-8C28-50355A6AC0B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.2.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4ABB4CA3-B087-480F-BF3F-AE3FAEC4241F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D0AF5FCE-D03F-4642-A266-F7F4F2577F8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2AF0C1DC-E17B-41F2-B537-FD8950371064",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.2.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "814FB6AA-4325-4AE6-9F92-01037EBE16EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "BAACFFD2-AD71-4812-883A-7E27ECD79945",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2745C09B-1A58-47AA-99CF-7860CB3F9FED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5AD6D54E-2336-4F94-B336-390123A3D2E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "75994E15-A991-4336-85FC-10CBAE5C69E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "73193F21-2BD0-4481-9EBF-458984F1FC23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBD2130-EB88-4988-8995-CAC28710F3D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "04FCBE2B-A0DD-475C-94C6-01B365FA8705",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AAA1F712-56A8-4EEF-9220-7F047423611A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "78D7CE72-75BD-477B-A75D-8E0F8DB7678D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D6EC83A4-6CD0-4575-B504-0E4839DFF2A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BCBA7C49-82DC-42E6-BA32-624DCC91EE08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F976310D-C749-4664-8AA4-548D23C39BCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "52F58109-88F6-476D-B08A-801EC0A69BDA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.7.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "484046E8-4048-4397-B391-AFB7EF38993C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.7.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "905F3804-FAE0-4940-83D3-591A55A0B325",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.7.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "EC27E1DD-648A-4FFC-8F4C-B3826329AC9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E5F50475-6C2B-4DEF-90B1-AEFACF6954F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7CEB468C-0748-4838-AD9E-ECF9B920B19A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:user_account_and_authentication:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "09DC2E28-7D43-4323-A522-7FFEACB5E88A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cloudfoundry:uaa-release:2:*:*:*:*:*:*:*",
"matchCriteriaId": "8703E628-1ECE-4CA2-8003-DC902E920EE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:uaa-release:3:*:*:*:*:*:*:*",
"matchCriteriaId": "770AFCA5-A1FA-4CB6-98BF-A226D4DF429A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cloudfoundry:uaa-release:4:*:*:*:*:*:*:*",
"matchCriteriaId": "3F6047B3-346D-4809-B713-9513935D5783",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pivotal:elastic_runtime:1.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1D5416C8-AB64-4BC5-B1FE-5C08F7D5AF82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pivotal:elastic_runtime:1.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "459E7CBD-AF09-43F8-B224-6BF8BB4D396E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pivotal:elastic_runtime:1.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7E4BB9CD-3D23-4CC1-AEFA-19CADB24EFBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pivotal:elastic_runtime:1.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "AD1D43E8-A4E8-4D5E-B482-B301BAC99846",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pivotal:elastic_runtime:1.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F5A0057F-FE6D-450B-83BF-00BB9D9DFCDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pivotal:elastic_runtime:1.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "3A1763BC-6CD0-4AAE-BAA0-BE5F21EC7EDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pivotal:elastic_runtime:1.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "3E18E06E-FF5F-431D-A613-99FE7130BCD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pivotal:elastic_runtime:1.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "B04F41B2-E70D-4D5E-AB1E-2595A16AF3BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pivotal:elastic_runtime:1.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "38F08EF3-A4A2-423E-A4B8-486220716DB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pivotal:elastic_runtime:1.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "08D63E00-1DE1-4F76-A7E4-43BA0D643682",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pivotal:elastic_runtime:1.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6BEA097B-09DC-40A8-9353-A3BF45AF3A48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pivotal:elastic_runtime:1.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "3D149DEB-8FDB-42B3-A748-0A966D82DCA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pivotal:elastic_runtime:1.6.12:*:*:*:*:*:*:*",
"matchCriteriaId": "77ECF4F7-BF73-46D8-AC12-300135C1FC38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pivotal:elastic_runtime:1.6.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E827400C-F2C5-455E-8347-CD3628CACBCA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0 through 1.6.13 allows remote authenticated users with privileges in one zone to gain privileges and perform operations on a different zone via unspecified vectors."
},
{
"lang": "es",
"value": "La caracter\u00edstica de zonas de identidad en Pivotal Cloud Foundry 208 a 229; UAA 2.0.0 a 2.7.3 y 3.0.0; UAA-Release 2 hasta la 4, cuando se configura con m\u00faltiples zonas de identidad; y Elastic Runtime 1.6.0 hasta la 1.6.13 permite que los usuarios remotos autenticados con privilegios en una zona obtengan privilegios y realicen operaciones en una zona diferente mediante vectores no especificados."
}
],
"id": "CVE-2016-0732",
"lastModified": "2026-06-17T00:38:06.823",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-09-07T13:29:00.293",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "https://pivotal.io/security/cve-2016-0732"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "https://pivotal.io/security/cve-2016-0732"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-269"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…