PT-2017-8327 · Cloud Foundry+1 · Login-Server+3

Published 2017-05-25 · Updated 2022-05-13 · CVE-2016-3084

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry versions prior to v236 UAA versions prior to v3.3.0 UAA versions prior to v10 Login-server all versions Pivotal Elastic Runtime versions prior to 1.7.2

Description The UAA reset password flow is vulnerable to a brute force attack due to multiple active codes at a given time. This issue is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

Recommendations For Cloud Foundry versions prior to v236, update to a version later than v236. For UAA versions prior to v3.3.0, update to a version later than v3.3.0. For UAA versions prior to v10, update to a version later than v10. For Login-server all versions, consider disabling the UAA internal user store for authentication until a patch is available. For Pivotal Elastic Runtime versions prior to 1.7.2, update to a version later than 1.7.2.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-3084

GHSA-FM5C-2RWC-887W

Affected Products

Cloud Foundry

Login-Server

Pivotal Elastic Runtime

Uaa

References · 13

• https://pivotal.io/security/cve-2016-3084 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3084 · Security Note
• https://osv.dev/vulnerability/GHSA-fm5c-2rwc-887w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-3084 · Vendor Advisory
• https://github.com/cloudfoundry/uaa · Note
• https://github.com/cloudfoundry/uaa/commit/b3834364ab573e9655348193780a56a602fe87b7 · Note
• https://github.com/cloudfoundry/uaa/commit/14350228989e2aee900b8d48a848293bb5152b6f · Note
• https://github.com/cloudfoundry/uaa/commit/66132926f1bac0b878da5841be2f93fa5075d88f · Note
• https://github.com/cloudfoundry/uaa/commit/460627ed419e4227b10ff121248b3ffc009011a9 · Note
• https://github.com/cloudfoundry/uaa/commit/1d3ad7399d010f6a29dc3bf8139d792121301ab8 · Note
• https://github.com/cloudfoundry/uaa/commit/5c2377487bef9d716d5c8e5717df1fc00bc7b000 · Note
• https://github.com/cloudfoundry/uaa/commit/4a119d314744460ed56bcd740b2e913bf3f560c1 · Note
• https://t.me/cvenotify/18787 · Telegram Post