CVE-2016-0781 The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions pr...
MediumCVSS 6.1
EPSS 0.66%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions prior to 1.6.20 are vulnerable to an XSS attack by specifying malicious java script content in either the OAuth scopes (SCIM groups) or SCIM group descriptions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cloudfoundry cloud foundry uaa bosh | = 2 | No fix listed |
| cloudfoundry cloud foundry uaa bosh | = 3 | No fix listed |
| cloudfoundry cloud foundry uaa bosh | = 4 | No fix listed |
| cloudfoundry cloud foundry uaa bosh | = 5 | No fix listed |
| cloudfoundry cloud foundry uaa bosh | = 6 | No fix listed |
| cloudfoundry cloud foundry uaa bosh | = 7 | No fix listed |
| pivotal software cloud foundry | = 208 | No fix listed |
| pivotal software cloud foundry | = 209 | No fix listed |
| pivotal software cloud foundry | = 210 | No fix listed |
| pivotal software cloud foundry | = 211 | No fix listed |
| pivotal software cloud foundry | = 212 | No fix listed |
| pivotal software cloud foundry | = 213 | No fix listed |
| pivotal software cloud foundry | = 214 | No fix listed |
| pivotal software cloud foundry | = 215 | No fix listed |
| pivotal software cloud foundry | = 216 | No fix listed |
| pivotal software cloud foundry | = 217 | No fix listed |
| pivotal software cloud foundry | = 218 | No fix listed |
| pivotal software cloud foundry | = 219 | No fix listed |
| pivotal software cloud foundry | = 220 | No fix listed |
| pivotal software cloud foundry | = 221 | No fix listed |
| pivotal software cloud foundry | = 222 | No fix listed |
| pivotal software cloud foundry | = 223 | No fix listed |
| pivotal software cloud foundry | = 224 | No fix listed |
| pivotal software cloud foundry | = 225 | No fix listed |
| pivotal software cloud foundry | = 226 | No fix listed |
Show 38 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pivotal software cloud foundry | = 227 | No fix listed |
| pivotal software cloud foundry | = 228 | No fix listed |
| pivotal software cloud foundry | = 229 | No fix listed |
| pivotal software cloud foundry | = 230 | No fix listed |
| pivotal software cloud foundry | = 231 | No fix listed |
| pivotal software cloud foundry | = 241 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.0 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.1 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.2 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.3 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.4 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.5 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.6 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.7 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.8 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.9 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.10 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.11 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.12 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.13 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.14 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.15 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.16 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.17 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.18 | No fix listed |
| pivotal software cloud foundry elastic runtime | = 1.6.19 | No fix listed |
| pivotal software cloud foundry uaa | <= 2.7.4.1 | No fix listed |
| pivotal software cloud foundry uaa | = 3.0.0 | No fix listed |
| pivotal software cloud foundry uaa | = 3.0.1 | No fix listed |
| pivotal software cloud foundry uaa | = 3.1.0 | No fix listed |
| pivotal software cloud foundry uaa | = 3.2.0 | No fix listed |
| pivotal software login-server | All versions | No fix listed |
| pivotal Cloud Foundry | = v208 to v231 | No fix listed |
| pivotal Cloud Foundry | = Login-server v1.6 to v1.14 | No fix listed |
| pivotal Cloud Foundry | = UAA v2.0.0 to v2.7.4.1 | No fix listed |
| pivotal Cloud Foundry | = UAA v3.0.0 to v3.2.0 | No fix listed |
| pivotal Cloud Foundry | = UAA-Release v2 to v7 | No fix listed |
| pivotal Cloud Foundry | = Elastic Runtime 1.6.x versions prior to 1.6.20 | No fix listed |
References
- pivotal.io vendor-advisory