Medium severity · published Apr 24, 2017
CVE-2016-5016
Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic…
5.9
CVSS
1%
EPSS
No
On KEV
Description
Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cloud Foundry · Pivotal Software
through 239 · source: NVD
CF
Cloud Foundry Elastic Runtime · Pivotal Software
1.6.0 before 1.6.35; 1.7.0 before 1.7.13 · source: NVD
CF
Cloud Foundry Uaa · Pivotal Software
through 3.4.1 · source: NVD
CF
Cloud Foundry Uaa-release · Pivotal Software
through 12.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-5016
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-5016
Release Notes
https://github.com/cloudfoundry/cf-release/releases/tag/v240
Release Notes
https://github.com/cloudfoundry/uaa-release/releases/tag/v11.3
Release Notes
https://github.com/cloudfoundry/uaa-release/releases/tag/v12.3
Release Notes
https://github.com/cloudfoundry/uaa/releases/tag/2.7.4.6
Release Notes
https://github.com/cloudfoundry/uaa/releases/tag/3.3.0.3
Release Notes
https://github.com/cloudfoundry/uaa/releases/tag/3.4.2
More from Cloud Foundry
9.8
CVE-2016-5006
The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential information via…
9.6
CVE-2016-6637
Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH…
8.8
CVE-2016-4468
SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before…
8.8
CVE-2016-6651
The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before…
8.1
CVE-2016-3084
The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier…