Read the docs
TI-2016-00806 Aliases CVE-2016-0897GHSA-9j6w-4w73-52jh

Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 and 1.7.x before 1.7.8, when vCloud…

Priority MEDIUM 45CWE-310Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 and 1.7.x before 1.7.8, when vCloud or vSphere is used, does not properly enable SSH access for operators, which has unspecified impact and remote attack vectors.

Why it matters now

EPSS 0.01526 74th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:pivotal_software:operations_manager:*:*:*:*:*:*:*:*up to 1.6.16VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:operations_manager:1.7.0:*:*:*:*:*:*:*1.7.0VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:operations_manager:1.7.1:*:*:*:*:*:*:*1.7.1VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:operations_manager:1.7.2:*:*:*:*:*:*:*1.7.2VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:operations_manager:1.7.3:*:*:*:*:*:*:*1.7.3VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:operations_manager:1.7.4:*:*:*:*:*:*:*1.7.4VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:operations_manager:1.7.5:*:*:*:*:*:*:*1.7.5VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:operations_manager:1.7.6:*:*:*:*:*:*:*1.7.6VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:operations_manager:1.7.7:*:*:*:*:*:*:*1.7.7VulnerableSpring by Pivotal
  • cpe:2.3:a:pivotal_software:operations_manager:*:*:*:*:*:*:*:* Versions up to 1.6.16 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:operations_manager:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:operations_manager:1.7.1:*:*:*:*:*:*:* Versions 1.7.1 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:operations_manager:1.7.2:*:*:*:*:*:*:* Versions 1.7.2 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:operations_manager:1.7.3:*:*:*:*:*:*:* Versions 1.7.3 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:operations_manager:1.7.4:*:*:*:*:*:*:* Versions 1.7.4 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:operations_manager:1.7.5:*:*:*:*:*:*:* Versions 1.7.5 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:operations_manager:1.7.6:*:*:*:*:*:*:* Versions 1.7.6 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:operations_manager:1.7.7:*:*:*:*:*:*:* Versions 1.7.7 Vulnerable ·Spring by Pivotal

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-0897
  2. 2026-10-03 Alias added: GHSA-9j6w-4w73-52jh

References

Advisory 1

  • TI-2016-00794 Pivotal Cloud Foundry (PCF) Ops Manager before 1.5.14 and 1.6.x before 1.6.9 uses the… CVSS 3.0CRITICAL 9.8
  • TI-2018-11241 Pivotal Operations Manager gives all users heightened privileges CVSS 3.0CRITICAL 9.0
  • TI-2018-07867 Pivotal Operations Manager UAA config - temp Ram Disk CVSS 3.0HIGH 8.8
  • TI-2019-08428 UAA clients.write vulnerability CVSS 3.1HIGH 7.5
  • TI-2019-02790 Reflected XSS in Pivotal Operations Manager CVSS 3.0HIGH 7.2
  • TI-2019-08449 Pivotal Ops Manager logs query parameters in tomcat access file CVSS 3.1MEDIUM 6.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences