CVE-2016-4435: Critical severity pivotal bosh stemcell vulnerability
An endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6 and 3146.13 may allow unauthenticated clients to read or write blobs or cause a denial of service attack on the Director VM. This vulnerability requires that the unauthenticated clients guess or find a URL matching an existing GUID.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4435?
CVE-2016-4435 has a high severity due to the potential for unauthenticated access and denial of service on the BOSH Director VM.
How do I fix CVE-2016-4435?
To fix CVE-2016-4435, upgrade to BOSH stemcell version 3232.6 or later and version 3146.14 or later.
What systems are affected by CVE-2016-4435?
CVE-2016-4435 affects Pivotal Bosh Stemcell versions prior to 3232.6 and version 3146.13.
Can CVE-2016-4435 lead to data exposure?
Yes, CVE-2016-4435 may allow unauthenticated clients to read or write blobs, potentially exposing sensitive data.
Is CVE-2016-4435 a local or remote vulnerability?
CVE-2016-4435 is considered a remote vulnerability, as it can be exploited by unauthenticated clients over the network.