CVE-2016-3084: XSS
The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3084?
CVE-2016-3084 is classified as a high severity vulnerability due to its susceptibility to brute force attacks.
How do I fix CVE-2016-3084?
To fix CVE-2016-3084, upgrade to UAA release version 3.3.0.1 or newer, or ensure your Cloud Foundry and Pivotal Elastic Runtime versions are above the vulnerable thresholds.
Which versions are affected by CVE-2016-3084?
CVE-2016-3084 affects Cloud Foundry release v236 and earlier, UAA release v3.3.0 and earlier, and all versions of the Login-server.
What types of attacks does CVE-2016-3084 support?
CVE-2016-3084 allows attackers to perform brute force attacks via the UAA reset password flow.
Is CVE-2016-3084 still a concern for current users?
Yes, CVE-2016-3084 remains a concern for users running any affected versions of the software, which should be updated to mitigate the risk.