5.9med
CVE-2016-5016
Cloud Foundry vulnerable to Improper Certificate Validation
Also known as GHSA-rc2r-w8jv-vggp
Published 9 y ago · modified 4 mo ago · JSON
CVSS
5.9
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 64%
Public exploits
0
none known
Summary
Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.
Exploit prediction (EPSS)
1.03% probability of exploitation in the next 30 days, higher than 64% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| GitHub | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.cloudfoundry.identity:cloudfoundry-identity-server | >=3.0.0, <3.3.0.3 >=3.4.0, <3.4.2 | 3.3.0.3 3.4.2 |
Classification
- Weakness
- CWE-295 Improper Certificate Validation
References
- github.com /cloudfoundry/uaa/releases/tag/2.7.4.6 · x_refsource_CONFIRM, x_transferred
- github.com /cloudfoundry/uaa/releases/tag/3.3.0.3 · x_refsource_CONFIRM, x_transferred
- github.com /cloudfoundry/uaa-release/releases/tag/v12.3 · x_refsource_CONFIRM, x_transferred
- github.com /cloudfoundry/uaa/releases/tag/3.4.2 · x_refsource_CONFIRM, x_transferred
- github.com /cloudfoundry/cf-release/releases/tag/v240 · x_refsource_CONFIRM, x_transferred
- pivotal.io /security/cve-2016-5016 · x_refsource_CONFIRM, x_transferred
- github.com /cloudfoundry/uaa-release/releases/tag/v11.3 · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-5016 · advisory
- github.com /cloudfoundry/uaa/commit/0a78612f981c541ad2d997e6a365f2a0b3e799d9 · web
- github.com /cloudfoundry/uaa/commit/bc91ccd2029e8f1cea0c647f0c9aad4585f7a2c · web
- github.com /cloudfoundry/uaa/commit/f97049df1c6c03effda5049c41704ac831ff3925 · web
Sources
- CVE List: CVE-2016-5016
- GitHub Advisory: GHSA-rc2r-w8jv-vggp
- NVD: CVE-2016-5016
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.