CVE-2016-0708

{"id": "CVE-2016-0708", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2018-07-11T20:29:00.227", "references": [{"url": "https://www.cloudfoundry.org/blog/cve-2016-0708/", "tags": ["Mitigation", "Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but not limited to environment variables and bound service details. For applications to be vulnerable, they must have been staged using automatic buildpack detection, passed through the Java Buildpack detection script, and allow the serving of static content from within the deployed artifact. The default Apache Tomcat configuration in the affected java buildpack versions for some basic web application archive (WAR) packaged applications are vulnerable to this issue."}, {"lang": "es", "value": "Las aplicaciones desplegadas en Cloud Foundry, desde la versi\u00f3n v166 hasta la v227, podr\u00edan ser vulnerables a una divulgaci\u00f3n de informaci\u00f3n remota que incluye, pero no se limita a, las variables de entorno y los detalles del servicio bound. Para que las aplicaciones sean vulnerables, deben haber sido preparadas mediante la detecci\u00f3n autom\u00e1tica de buildpack, pasadas a trav\u00e9s del script de detecci\u00f3n de Java Buildpack y deben permitir que se sirva contenido est\u00e1tico desde dentro del artefactos desplegados. La configuraci\u00f3n por defecto de Apache Tomcat en las versiones afectadas del Buildpack de Java para algunas aplicaciones WAR (web application archive) empaquetadas son vulnerables a este problema."}], "lastModified": "2018-09-11T18:49:33.573", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cloudfoundry:cf-release:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "702C39AA-F1A9-48C6-BA11-D0A12B20F3D4", "versionEndIncluding": "227", "versionStartIncluding": "166"}, {"criteria": "cpe:2.3:a:cloudfoundry:java_buildpack:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C70F440-364D-412F-A05C-F170E7F9A463", "versionEndIncluding": "3.4", "versionStartIncluding": "2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}