cnvd - cnvd-2016-10776

CNVD-2016-10776

Vulnerability from cnvd - Published: 2016-11-09

Title

多款Pivotal产品重定向漏洞

Description

Pivotal Cloud Foundry是美国Pivotal Software公司的一套开源的平台即服务（PaaS）云计算平台。多款Pivotal产品存在重定向漏洞，攻击者可利用漏洞通过构造一个精心制作的URL，当用户点击连接后，可被重定向到攻击者控制的一个网站。

Severity

中

Patch Name

多款Pivotal产品重定向漏洞的补丁

Patch Description

Pivotal Cloud Foundry是美国Pivotal Software公司的一套开源的平台即服务（PaaS）云计算平台。多款Pivotal产品存在重定向漏洞，攻击者可利用漏洞通过构造一个精心制作的URL，当用户点击连接后，可被重定向到攻击者控制的一个网站。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

用户可联系供应商获得补丁信息： https://pivotal.io/platform

Reference

http://www.securityfocus.com/bid/94126

Impacted products

Name
['Pivotal Software Cloud Foundry Elastic Runtime 1.8.，<1.8.12', 'Pivotal Software Cloud Foundry Ops Manager 1.7.，<1.7.18', 'Pivotal Software Cloud Foundry Ops Manager 1.8.*，<1.8.10']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "94126"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-6657"
    }
  },
  "description": "Pivotal Cloud Foundry\u662f\u7f8e\u56fdPivotal Software\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684\u5e73\u53f0\u5373\u670d\u52a1\uff08PaaS\uff09\u4e91\u8ba1\u7b97\u5e73\u53f0\u3002\r\n\r\n\u591a\u6b3ePivotal\u4ea7\u54c1\u5b58\u5728\u91cd\u5b9a\u5411\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u901a\u8fc7\u6784\u9020\u4e00\u4e2a\u7cbe\u5fc3\u5236\u4f5c\u7684URL\uff0c\u5f53\u7528\u6237\u70b9\u51fb\u8fde\u63a5\u540e\uff0c\u53ef\u88ab\u91cd\u5b9a\u5411\u5230\u653b\u51fb\u8005\u63a7\u5236\u7684\u4e00\u4e2a\u7f51\u7ad9\u3002",
  "discovererName": "Lenu Galardi.",
  "formalWay": "\u7528\u6237\u53ef\u8054\u7cfb\u4f9b\u5e94\u5546\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://pivotal.io/platform",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-10776",
  "openTime": "2016-11-09",
  "patchDescription": "Pivotal Cloud Foundry\u662f\u7f8e\u56fdPivotal Software\u516c\u53f8\u7684\u4e00\u5957\u5f00\u6e90\u7684\u5e73\u53f0\u5373\u670d\u52a1\uff08PaaS\uff09\u4e91\u8ba1\u7b97\u5e73\u53f0\u3002\r\n\r\n\u591a\u6b3ePivotal\u4ea7\u54c1\u5b58\u5728\u91cd\u5b9a\u5411\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u901a\u8fc7\u6784\u9020\u4e00\u4e2a\u7cbe\u5fc3\u5236\u4f5c\u7684URL\uff0c\u5f53\u7528\u6237\u70b9\u51fb\u8fde\u63a5\u540e\uff0c\u53ef\u88ab\u91cd\u5b9a\u5411\u5230\u653b\u51fb\u8005\u63a7\u5236\u7684\u4e00\u4e2a\u7f51\u7ad9\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3ePivotal\u4ea7\u54c1\u91cd\u5b9a\u5411\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Pivotal Software Cloud Foundry Elastic Runtime 1.8.*\uff0c\u003c1.8.12",
      "Pivotal Software Cloud Foundry Ops Manager 1.7.*\uff0c\u003c1.7.18",
      "Pivotal Software Cloud Foundry Ops Manager 1.8.*\uff0c\u003c1.8.10"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/94126",
  "serverity": "\u4e2d",
  "submitTime": "2016-11-08",
  "title": "\u591a\u6b3ePivotal\u4ea7\u54c1\u91cd\u5b9a\u5411\u6f0f\u6d1e"
}

CVE-2016-6657 (GCVE-0-2016-6657)

Vulnerability from cvelistv5 – Published: 2016-12-16 09:02 – Updated: 2024-08-06 01:36

Summary

An open redirect vulnerability has been detected with some Pivotal Cloud Foundry Elastic Runtime components. Users of affected versions should apply the following mitigation: Upgrade PCF Elastic Runtime 1.8.x versions to 1.8.12 or later. Upgrade PCF Ops Manager 1.7.x versions to 1.7.18 or later and 1.8.x versions to 1.8.10 or later.

Severity ?

No CVSS data available.

CWE

Open redirect vulnerability

Assigner

dell

References

URL

Tags

	https://pivotal.io/security/cve-2016-6657	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/94126	vdb-entryx_refsource_BID

Impacted products

	Vendor	Product	Version
	n/a	PCF Elastic Runtime 1.8.x versions prior to 1.8.12 and PCF Ops Manager 1.7.x versions prior to 1.7.18 and 1.8.x versions prior to 1.8.10	Affected: PCF Elastic Runtime 1.8.x versions prior to 1.8.12 and PCF Ops Manager 1.7.x versions prior to 1.7.18 and 1.8.x versions prior to 1.8.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:36:29.434Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://pivotal.io/security/cve-2016-6657"
          },
          {
            "name": "94126",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94126"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PCF Elastic Runtime 1.8.x versions prior to 1.8.12 and PCF Ops Manager 1.7.x versions prior to 1.7.18 and 1.8.x versions prior to 1.8.10",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "PCF Elastic Runtime 1.8.x versions prior to 1.8.12 and PCF Ops Manager 1.7.x versions prior to 1.7.18 and 1.8.x versions prior to 1.8.10"
            }
          ]
        }
      ],
      "datePublic": "2016-12-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An open redirect vulnerability has been detected with some Pivotal Cloud Foundry Elastic Runtime components. Users of affected versions should apply the following mitigation: Upgrade PCF Elastic Runtime 1.8.x versions to 1.8.12 or later. Upgrade PCF Ops Manager 1.7.x versions to 1.7.18 or later and 1.8.x versions to 1.8.10 or later."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Open redirect vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-16T10:57:01",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://pivotal.io/security/cve-2016-6657"
        },
        {
          "name": "94126",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94126"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security_alert@emc.com",
          "ID": "CVE-2016-6657",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PCF Elastic Runtime 1.8.x versions prior to 1.8.12 and PCF Ops Manager 1.7.x versions prior to 1.7.18 and 1.8.x versions prior to 1.8.10",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "PCF Elastic Runtime 1.8.x versions prior to 1.8.12 and PCF Ops Manager 1.7.x versions prior to 1.7.18 and 1.8.x versions prior to 1.8.10"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An open redirect vulnerability has been detected with some Pivotal Cloud Foundry Elastic Runtime components. Users of affected versions should apply the following mitigation: Upgrade PCF Elastic Runtime 1.8.x versions to 1.8.12 or later. Upgrade PCF Ops Manager 1.7.x versions to 1.7.18 or later and 1.8.x versions to 1.8.10 or later."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Open redirect vulnerability"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://pivotal.io/security/cve-2016-6657",
              "refsource": "CONFIRM",
              "url": "https://pivotal.io/security/cve-2016-6657"
            },
            {
              "name": "94126",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94126"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2016-6657",
    "datePublished": "2016-12-16T09:02:00",
    "dateReserved": "2016-08-10T00:00:00",
    "dateUpdated": "2024-08-06T01:36:29.434Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2016-10776

CVE-2016-6657 (GCVE-0-2016-6657)

Tags

Sightings

Nomenclature