Is CVE-2016-9882 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-9882 being exploited in the wild.

How severe is CVE-2016-9882?

High severity, with a CVSS score of 7.5, published 13 January 2017.

Which products and versions are affected?

Cloud Foundry Foundation cf-release prior to v250; Cloud Foundry Foundation CAPI-release prior to v1.12.0.

Is there a fix for CVE-2016-9882?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2016-9882 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2016-9882?

Check whether you run Cloudfoundry Capi-Release or Cloudfoundry Cf-Release. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-9882: Cloud Foundry Cloud Controller sensitive information disclosure in logs

CVE-2016-9882 · Severity: high · CVSS 7.5 · Published 2017-01-13

Cloud Foundry, a platform for managing cloud applications, was found to be recording sensitive login credentials in its system logs. These logs are stored on disk and often sent to central monitoring tools, potentially exposing passwords and access keys to unauthorized staff or anyone with access to the logging infrastructure. Organizations should update their software and rotate any credentials that may have been exposed in these logs.

Vendors: Cloudfoundry.

Quick answers

Is CVE-2016-9882 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-9882 being exploited in the wild.
How severe is CVE-2016-9882?: High severity, with a CVSS score of 7.5, published 13 January 2017.
Which products and versions are affected?: Cloud Foundry Foundation cf-release prior to v250; Cloud Foundry Foundation CAPI-release prior to v1.12.0.
Is there a fix for CVE-2016-9882?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-9882 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2016-9882?: Check whether you run Cloudfoundry Capi-Release or Cloudfoundry Cf-Release. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A sensitive information disclosure vulnerability (CWE-532) exists in Cloud Foundry's Cloud Controller component. The system incorrectly logs credentials returned from service brokers into system component logs. These logs are written to local disk and frequently forwarded to external log aggregators via syslog. An attacker with access to the logging infrastructure or the local filesystem could retrieve these plaintext credentials to gain unauthorized access to bound services. The issue is resolved in cf-release v250 and CAPI-release v1.12.0.

Affected products

Cloud Foundry Foundation cf-release prior to v250
Cloud Foundry Foundation CAPI-release prior to v1.12.0

Timeline

2017-01-09: advisory: Initial vulnerability report published by Cloud Foundry Foundation
2017-01-13: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.