CVSS 3.0
9.6 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HCVE-2016-6637
Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops Manager 1.7.x before 1.7.13 and 1.8.x before 1.8.1 allow remote attackers to hijack the authentication of unspecified victims for requests that approve or deny a scope via a profile or authorize approval page.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
- CWE
- CWE-352
- Published
- Modified
- Record from
- the NVD, synced
Affected
- cloudfoundry:cloud_foundry_uaa_bosh
- pivotal_software:cloud_foundry
- pivotal_software:cloud_foundry_elastic_runtime
- pivotal_software:cloud_foundry_ops_manager
- pivotal_software:cloud_foundry_uaa
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-4m8c-h7fr-gq5c | Maven | org.cloudfoundry.identity:cloudfoundry-identity-server | >=2.0.0 <2.7.4.7 | 2.7.4.7 |
| GHSA-4m8c-h7fr-gq5c | Maven | org.cloudfoundry.identity:cloudfoundry-identity-server | >=3.0.0 <3.3.0.5 | 3.3.0.5 |
| GHSA-4m8c-h7fr-gq5c | Maven | org.cloudfoundry.identity:cloudfoundry-identity-server | >=3.4.0 <3.4.4 | 3.4.4 |
| GHSA-4m8c-h7fr-gq5c | Maven | org.cloudfoundry.identity:cloudfoundry-identity-server | >=3.5.0 <3.7.0 | 3.7.0 |