Multiple Pivotal Products CVE-2015-1834 Directory Traversal Vulnerability

Bugtraq ID:	98691
Class:	Input Validation Error
CVE:	CVE-2015-1834
Remote:	Yes
Local:	No
Published:	May 25 2017 12:00AM
Updated:	May 25 2017 12:00AM
Credit:	Swisscom / SEC Consult.
Vulnerable:	Pivotal Cloud Foundry Runtime 207 Pivotal Cloud Foundry Elastic Runtime 1.4.2
Not Vulnerable:	Pivotal Cloud Foundry Runtime 208 Pivotal Cloud Foundry Elastic Runtime 1.4.3

Multiple Pivotal Products CVE-2015-1834 Directory Traversal Vulnerability

Multiple Pivotal Products are prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.

Remote attackers may use a specially crafted request with directory-traversal sequences ('../') to retrieve sensitive information and modify arbitrary files. This may aid in further attacks.

The following versions are vulnerable:

Cloud Foundry Runtime cf-release version 207 and prior and
Cloud Foundry Elastic Runtime versions prior to 1.4.2.

Multiple Pivotal Products CVE-2015-1834 Directory Traversal Vulnerability

Attackers can exploit this issue using browser or readily available tools.

Multiple Pivotal Products CVE-2015-1834 Directory Traversal Vulnerability

References:

• Pivotal Homepage (Pivotal)
  
• CVE-2015-1834 - Path Traversal Vulnerability (Pivotal)