CVE-2016-0781

Published: May 25, 2017Modified: May 13, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions prior to 1.6.20 are vulnerable to an XSS attack by specifying malicious java script content in either the OAuth scopes (SCIM groups) or SCIM group descriptions.

Affected (57)

Products: Cloudfoundry: Cloud Foundry Uaa Bosh · Pivotal Software: Cloud Foundry, Cloud Foundry Elastic Runtime, Cloud Foundry Uaa, Login Server

Cloudfoundry

1 product

Cloud Foundry Uaa Bosh

Pivotal Software

4 products

Cloud Foundry

Cloud Foundry Elastic Runtime

Cloud Foundry Uaa

Configuration A

57 vulnerable

Vulnerable Software	Affected Versions
Cloudfoundry Cloud Foundry Uaa Bosh	Version 2
Cloudfoundry Cloud Foundry Uaa Bosh	Version 3
Cloudfoundry Cloud Foundry Uaa Bosh	Version 4
Cloudfoundry Cloud Foundry Uaa Bosh	Version 5
Cloudfoundry Cloud Foundry Uaa Bosh	Version 6
Cloudfoundry Cloud Foundry Uaa Bosh	Version 7
Pivotal Software Cloud Foundry	Version 208
Pivotal Software Cloud Foundry	Version 209
Pivotal Software Cloud Foundry	Version 210
Pivotal Software Cloud Foundry	Version 211
Pivotal Software Cloud Foundry	Version 212
Pivotal Software Cloud Foundry	Version 213
Pivotal Software Cloud Foundry	Version 214
Pivotal Software Cloud Foundry	Version 215
Pivotal Software Cloud Foundry	Version 216
Pivotal Software Cloud Foundry	Version 217
Pivotal Software Cloud Foundry	Version 218
Pivotal Software Cloud Foundry	Version 219
Pivotal Software Cloud Foundry	Version 220
Pivotal Software Cloud Foundry	Version 221
Pivotal Software Cloud Foundry	Version 222
Pivotal Software Cloud Foundry	Version 223
Pivotal Software Cloud Foundry	Version 224
Pivotal Software Cloud Foundry	Version 225
Pivotal Software Cloud Foundry	Version 226
Pivotal Software Cloud Foundry	Version 227
Pivotal Software Cloud Foundry	Version 228
Pivotal Software Cloud Foundry	Version 229
Pivotal Software Cloud Foundry	Version 230
Pivotal Software Cloud Foundry	Version 231
Pivotal Software Cloud Foundry	Version 241
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.0
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.10
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.11
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.12
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.13
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.14
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.15
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.16
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.17
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.18
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.19
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.1
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.2
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.3
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.4
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.5
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.6
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.7
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.8
Pivotal Software Cloud Foundry Elastic Runtime	Version 1.6.9
Pivotal Software Cloud Foundry Uaa	Up to 2.7.4.1
Pivotal Software Cloud Foundry Uaa	Version 3.0.0
Pivotal Software Cloud Foundry Uaa	Version 3.0.1
Pivotal Software Cloud Foundry Uaa	Version 3.1.0
Pivotal Software Cloud Foundry Uaa	Version 3.2.0
Pivotal Software Login Server	All versions

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://pivotal.io/security/cve-2016-0781

Source: security_alert@emc.com

Vendor Advisory

https://pivotal.io/security/cve-2016-0781

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.