製品・ソフトウェアに関する情報

JVN脆弱性詳細

複数の Pivotal Cloud Foundry 製品における SQL インジェクションの脆弱性

タイトル	複数の Pivotal Cloud Foundry 製品における SQL インジェクションの脆弱性
概要	複数の Pivotal Cloud Foundry (PCF) 製品には、SQL インジェクションの脆弱性が存在します。
想定される影響	リモート認証されたユーザにより、任意の SQL コマンドを実行される可能性があります。
対策	ベンダ情報および参考情報を参照して適切な対策を実施してください。
公表日	2016年6月30日0:00
登録日	2017年5月16日15:24
最終更新日	2017年5月16日15:24

CVSS3.0 : 重要
スコア	8.8
ベクター	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS2.0 : 警告
スコア	6.5
ベクター	AV:N/AC:L/Au:S/C:P/I:P/A:P

影響を受けるシステム

Cloud Foundry Foundation

Cloud Foundry 238 未満

Elastic Runtime 1.7.7 未満の 1.7.x

Elastic Runtime 1.6.29 未満

Ops Manager 1.7.8 未満の 1.7.x

UAA 2.7.4.4 未満の 2.x

UAA 3.3.0.2 未満の 3.x

UAA 3.4.1 未満の 3.4.x

UAA BOSH 11.2 未満

UAA BOSH 12.2 未満の 12.x

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-4468	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4468
National Vulnerability Database (NVD)
2	CVE-2016-4468	https://nvd.nist.gov/vuln/detail/CVE-2016-4468
関連文書
3	CVE-2016-4468 UAA SQL Injection	https://lists.cloudfoundry.org/archives/list/cf-dev@lists.cloudfoundry.org/thread/WMTZBIH5U7DTOOX2SNRVTPQI3U2AINOB/

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-89	https://jvndb.jvn.jp/ja/cwe/CWE-89.html

ベンダー情報

No	名前	URL
Cloud Foundry Foundation
1	Top Page	https://www.cloudfoundry.org/

変更履歴

No	変更内容	変更日
0	[2017年05月16日] 掲載	2018年2月17日10:37

NVD脆弱性情報

CVE-2016-4468

概要	SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before 12.2; Elastic Runtime before 1.6.29 and 1.7.x before 1.7.7; and Ops Manager 1.7.x before 1.7.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
公表日	2017年4月12日0:59
登録日	2021年1月26日14:12
最終更新日	2024年11月21日11:52

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.5:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry::::::::		237.0
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.8.0:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_uaa::::::::		3.4.0
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.13:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.7.6:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.7:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.6:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.7.1:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_ops_manager:1.7.3:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_ops_manager:1.7.4:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.9:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.22:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.14:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.25:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.17:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.7.4:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.10:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.0:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.7.7:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.20:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.2:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_ops_manager:1.7.5:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.23:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.7.0:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.15:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_ops_manager:1.7.2:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.3:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.28:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.7.5:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.11:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.4:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.18:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_ops_manager:1.7.8:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.12:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_ops_manager:1.7.7:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_ops_manager:1.7.1:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.8:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.1:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.26:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.27:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.19:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.7.3:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.7.2:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.21:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_ops_manager:1.7.6:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_ops_manager:1.7.0:::::::*
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh::::::::		12.0

構成1	以上	以下	より上	未満
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.5:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry::::::::		237.0
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.8.0:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_uaa::::::::		3.4.0
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.13:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.7.6:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.7:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.6:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.7.1:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_ops_manager:1.7.3:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_ops_manager:1.7.4:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.9:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.22:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.14:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.25:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.17:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.7.4:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.10:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.0:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.7.7:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.20:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.2:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_ops_manager:1.7.5:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.23:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.7.0:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.15:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_ops_manager:1.7.2:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.3:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.28:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.7.5:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.11:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.4:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.18:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_ops_manager:1.7.8:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.12:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_ops_manager:1.7.7:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_ops_manager:1.7.1:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.8:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.1:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.26:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.27:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.19:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.7.3:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.7.2:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.21:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_ops_manager:1.7.6:::::::*
cpe:2.3:a:pivotal_software:cloud_foundry_ops_manager:1.7.0:::::::*
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh::::::::		12.0

No	URL	タグ
1	https://lists.cloudfoundry.org/archives/list/cf-dev%40lists.cloudfoundry.org/thread/WMTZBIH5U7DTOOX2SNRVTPQI3U2AINOB/
2	https://lists.cloudfoundry.org/archives/list/cf-dev%40lists.cloudfoundry.org/thread/WMTZBIH5U7DTOOX2SNRVTPQI3U2AINOB/
3	https://pivotal.io/security/cve-2016-4468	Mitigation Patch Vendor Advisory
4	https://pivotal.io/security/cve-2016-4468	Mitigation Patch Vendor Advisory