« Volver al listado

CVE-2016-4435

Estado: ModificadaCrítica (9)—

An endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6 and 3146.13 may allow unauthenticated clients to read or write blobs or cause a denial of service attack on the Director VM. This vulnerability requires that the unauthenticated clients guess or find a URL matching an existing GUID.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Pivotal — Bosh Stemcell

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-4435",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Pivotal",
          "product": "Cloud Foundry",
          "versions": [
            {
              "status": "affected",
              "version": "BOSH stemcell versions prior to 3232.6 and 3146.13"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-05-25T17:29:00.677",
  "references": [
    {
      "url": "https://pivotal.io/security/cve-2016-4435",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://pivotal.io/security/cve-2016-4435",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6 and 3146.13 may allow unauthenticated clients to read or write blobs or cause a denial of service attack on the Director VM. This vulnerability requires that the unauthenticated clients guess or find a URL matching an existing GUID."
    },
    {
      "lang": "es",
      "value": "Un endpoint del agente que se ejecuta en la máquina virtual BOSH Director con versiones de stemcell anteriores a la 3232.6 y a la 3146.13 puede permitir que clientes no autenticados lean o escriban en blobs o lleven a cabo un ataque de denegación de servicio (DoS) en la máquina virtual Director. Esta vulnerabilidad requiere que el cliente no autenticado adivine o encuentre una URL que coincida con un GUID existente."
    }
  ],
  "lastModified": "2026-06-17T00:47:33.090",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pivotal:bosh_stemcell:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A606F58B-76D5-4F09-9D5E-15B414DD55C5",
              "versionEndIncluding": "3232.4"
            },
            {
              "criteria": "cpe:2.3:a:pivotal:bosh_stemcell:3146.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C67E86BE-B3E7-454F-9DDB-BBCDA6F777C7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}