CVE-2016-5016

Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.

Published: Apr 24, 2017
Updated: Apr 13, 2023
CVE: CVE-2016-5016
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.9
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

CWE-295

OWASP TOP 10:

A3 - Sensitive Data Exposure

Affected Software
References

Software	From	Fixed in
pivotal_software / cloud_foundry_uaa	-	3.4.1.x
pivotal_software / cloud_foundry	-	239.x
pivotal_software / cloud_foundry_elastic_runtime	1.6.0	1.6.35
pivotal_software / cloud_foundry_elastic_runtime	1.7.0	1.7.13
pivotal_software / cloud_foundry_uaa-release	-	12.2.x

https://github.com/cloudfoundry/cf-release/releases/tag/v240
https://github.com/cloudfoundry/uaa-release/releases/tag/v11.3
https://github.com/cloudfoundry/uaa-release/releases/tag/v12.3
https://github.com/cloudfoundry/uaa/releases/tag/2.7.4.6
https://github.com/cloudfoundry/uaa/releases/tag/3.3.0.3
https://github.com/cloudfoundry/uaa/releases/tag/3.4.2
https://pivotal.io/security/cve-2016-5016

Vulnerability Database

289,784

CVE-2016-5016