CVE-2016-5006

CRITICAL

Cloud Foundry < 238.0 and Elastic Runtime < 1.6.32 - Exposure of Sensitive Information via Service Object Logging

Title source: llm
STIX 2.1

Description

The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential information via unspecified vectors.

References (2)

Core 2
Core References
Vendor Advisory x_refsource_confirm
https://www.cloudfoundry.org/CVE-2016-5006/
Vendor Advisory x_refsource_confirm
https://pivotal.io/security/cve-2016-5006

Scores

CVSS v3 9.8
EPSS 0.0114
EPSS Percentile 62.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-200
Status published
Products (13)
pivotal_software/cloud_foundry < 238.0
pivotal_software/cloud_foundry_elastic_runtime 1.7.0
pivotal_software/cloud_foundry_elastic_runtime 1.7.1
pivotal_software/cloud_foundry_elastic_runtime 1.7.2
pivotal_software/cloud_foundry_elastic_runtime 1.7.3
pivotal_software/cloud_foundry_elastic_runtime 1.7.4
pivotal_software/cloud_foundry_elastic_runtime 1.7.5
pivotal_software/cloud_foundry_elastic_runtime 1.7.6
pivotal_software/cloud_foundry_elastic_runtime 1.7.7
pivotal_software/cloud_foundry_elastic_runtime 1.7.8
... and 3 more
Published May 02, 2017
Tracked Since Feb 18, 2026