CVEvulnerability
CVE-2016-0732
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-09-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-269
Description
The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0 through 1.6.13 allows remote authenticated users with privileges in one zone to gain privileges and perform operations on a different zone via unspecified vectors.
Affected configurations
• cloudfoundry cf-release (>= 208 <= 229)
• cloudfoundry user account and authentication 2.0.0
• cloudfoundry user account and authentication 2.0.1
• cloudfoundry user account and authentication 2.0.2
• cloudfoundry user account and authentication 2.0.3
• cloudfoundry user account and authentication 2.1.0
• cloudfoundry user account and authentication 2.2.0
• cloudfoundry user account and authentication 2.2.1
• cloudfoundry user account and authentication 2.2.2
• cloudfoundry user account and authentication 2.2.3
• cloudfoundry user account and authentication 2.2.4
• cloudfoundry user account and authentication 2.2.4.1
• cloudfoundry user account and authentication 2.2.5
• cloudfoundry user account and authentication 2.2.5.2
• cloudfoundry user account and authentication 2.2.5.3
• cloudfoundry user account and authentication 2.2.6
• cloudfoundry user account and authentication 2.3.0
• cloudfoundry user account and authentication 2.3.1
• cloudfoundry user account and authentication 2.3.1.1
• cloudfoundry user account and authentication 2.4.0
• cloudfoundry user account and authentication 2.4.1
• cloudfoundry user account and authentication 2.5.0
• cloudfoundry user account and authentication 2.5.1
• cloudfoundry user account and authentication 2.5.2
• cloudfoundry user account and authentication 2.6.0
• cloudfoundry user account and authentication 2.6.1
• cloudfoundry user account and authentication 2.6.2
• cloudfoundry user account and authentication 2.7.0
• cloudfoundry user account and authentication 2.7.0.1
• cloudfoundry user account and authentication 2.7.0.2
• cloudfoundry user account and authentication 2.7.0.3
• cloudfoundry user account and authentication 2.7.1
• cloudfoundry user account and authentication 2.7.2
• cloudfoundry user account and authentication 2.7.3
• cloudfoundry uaa-release 2
• cloudfoundry uaa-release 3
• cloudfoundry uaa-release 4
• pivotal elastic runtime 1.6.0
• pivotal elastic runtime 1.6.1
• pivotal elastic runtime 1.6.2
• pivotal elastic runtime 1.6.3
• pivotal elastic runtime 1.6.4
• pivotal elastic runtime 1.6.5
• pivotal elastic runtime 1.6.6
• pivotal elastic runtime 1.6.7
• pivotal elastic runtime 1.6.8
• pivotal elastic runtime 1.6.9
• pivotal elastic runtime 1.6.10
• pivotal elastic runtime 1.6.11
• pivotal elastic runtime 1.6.12
• pivotal elastic runtime 1.6.13
Related
Weakness · CWE (1)
- CWE-269 Improper Privilege Management weakness
References
- https://pivotal.io/security/cve-2016-0732 Mitigation, Vendor Advisory
- https://pivotal.io/security/cve-2016-0732 Mitigation, Vendor Advisory