CVE-2016-3084

Published: May 25, 2017Modified: May 13, 2026

8.1

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

Affected (5)

Products: Cloudfoundry: Cloud Foundry Uaa Bosh · Pivotal Software: Cloud Foundry, Cloud Foundry Elastic Runtime, Cloud Foundry Uaa, Login Server

Cloudfoundry

1 product

Cloud Foundry Uaa Bosh

Pivotal Software

4 products

Cloud Foundry

Cloud Foundry Elastic Runtime

Cloud Foundry Uaa

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Cloudfoundry Cloud Foundry Uaa Bosh	Up to 10
Pivotal Software Cloud Foundry	Up to 236
Pivotal Software Cloud Foundry Elastic Runtime	Up to 1.7.1
Pivotal Software Cloud Foundry Uaa	Up to 3.3.0
Pivotal Software Login Server	All versions

Related CWEs

CWE-264

References (2)

https://pivotal.io/security/cve-2016-3084

Source: security_alert@emc.com

Vendor Advisory

https://pivotal.io/security/cve-2016-3084

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.