Skip to content

CVE-2016-3084 Cloud Foundry UAA reset password vulnerable to brute force attack

HighCVSS 8.1 EPSS 1.2%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

Affected products

ProductAffected versionsFixed in
org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) < 3.3.0.1 3.3.0.1
org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) = 3.0.0 No fix listed
org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) = 3.0.1 No fix listed
org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) = 3.1.0 No fix listed
org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) = 3.2.0 No fix listed
org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) = 3.2.1 No fix listed
org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) = 3.3.0 No fix listed
cloudfoundry cloud foundry uaa bosh <= 10 No fix listed
pivotal software cloud foundry <= 236 No fix listed
pivotal software cloud foundry elastic runtime <= 1.7.1 No fix listed
pivotal software cloud foundry uaa <= 3.3.0 No fix listed
pivotal software login-server All versions No fix listed
pivotal Cloud Foundry = release v236 and earlier versions No fix listed
pivotal Cloud Foundry = UAA release v3.3.0 and earlier versions No fix listed
pivotal Cloud Foundry = All versions of Login-server No fix listed
pivotal Cloud Foundry = UAA release v10 and earlier versions No fix listed
pivotal Cloud Foundry = Elastic Runtime versions prior to 1.7.2 No fix listed

References