CVE-2016-0781 : The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0

The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions prior to 1.6.20 are vulnerable to an XSS attack by specifying malicious java script content in either the OAuth scopes (SCIM groups) or SCIM group descriptions.

Published 2017-05-25 17:29:01

Updated 2021-08-06 14:47:27

Source Dell

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Exploit prediction scoring system (EPSS) score for CVE-2016-0781

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 37 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-0781

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
6.1	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2016-0781

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2016-0781

Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.4
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.4:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.5
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.5:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.6
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.6:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.7
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.7:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.1
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.1:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.3
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.3:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.8
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.8:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.10
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.10:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.12
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.12:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.13
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.13:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.14
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.14:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.15
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.15:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.0
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.0:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.2
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.2:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.9
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.9:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.11
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.11:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.16
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.16:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.17
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.17:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.19
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.19:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Elastic Runtime » Version: 1.6.18
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.18:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Uaa
Versions up to, including, (<=) 2.7.4.1
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Uaa » Version: 3.0.0
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.0.0:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Uaa » Version: 3.0.1
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.0.1:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Uaa » Version: 3.1.0
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.1.0:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry Uaa » Version: 3.2.0
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.2.0:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 219
cpe:2.3:a:pivotal_software:cloud_foundry:219:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 220
cpe:2.3:a:pivotal_software:cloud_foundry:220:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 221
cpe:2.3:a:pivotal_software:cloud_foundry:221:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 222
cpe:2.3:a:pivotal_software:cloud_foundry:222:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 208
cpe:2.3:a:pivotal_software:cloud_foundry:208:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 210
cpe:2.3:a:pivotal_software:cloud_foundry:210:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 215
cpe:2.3:a:pivotal_software:cloud_foundry:215:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 217
cpe:2.3:a:pivotal_software:cloud_foundry:217:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 224
cpe:2.3:a:pivotal_software:cloud_foundry:224:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 226
cpe:2.3:a:pivotal_software:cloud_foundry:226:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 211
cpe:2.3:a:pivotal_software:cloud_foundry:211:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 212
cpe:2.3:a:pivotal_software:cloud_foundry:212:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 213
cpe:2.3:a:pivotal_software:cloud_foundry:213:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 214
cpe:2.3:a:pivotal_software:cloud_foundry:214:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 227
cpe:2.3:a:pivotal_software:cloud_foundry:227:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 228
cpe:2.3:a:pivotal_software:cloud_foundry:228:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 230
cpe:2.3:a:pivotal_software:cloud_foundry:230:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 231
cpe:2.3:a:pivotal_software:cloud_foundry:231:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 209
cpe:2.3:a:pivotal_software:cloud_foundry:209:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 216
cpe:2.3:a:pivotal_software:cloud_foundry:216:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 218
cpe:2.3:a:pivotal_software:cloud_foundry:218:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 223
cpe:2.3:a:pivotal_software:cloud_foundry:223:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 241
cpe:2.3:a:pivotal_software:cloud_foundry:241:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 225
cpe:2.3:a:pivotal_software:cloud_foundry:225:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Cloud Foundry » Version: 229
cpe:2.3:a:pivotal_software:cloud_foundry:229:*:*:*:*:*:*:*
Matching versions
Pivotal Software » Login-server » Version: N/A
cpe:2.3:a:pivotal_software:login-server:-:*:*:*:*:*:*:*
Matching versions
Cloudfoundry » Cloud Foundry Uaa Bosh » Version: 6
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:6:*:*:*:*:*:*:*
Matching versions
Cloudfoundry » Cloud Foundry Uaa Bosh » Version: 4
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:4:*:*:*:*:*:*:*
Matching versions
Cloudfoundry » Cloud Foundry Uaa Bosh » Version: 5
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:5:*:*:*:*:*:*:*
Matching versions
Cloudfoundry » Cloud Foundry Uaa Bosh » Version: 2
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:2:*:*:*:*:*:*:*
Matching versions
Cloudfoundry » Cloud Foundry Uaa Bosh » Version: 3
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:3:*:*:*:*:*:*:*
Matching versions
Cloudfoundry » Cloud Foundry Uaa Bosh » Version: 7
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:7:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2016-0781

Exploit prediction scoring system (EPSS) score for CVE-2016-0781

CVSS scores for CVE-2016-0781

CWE ids for CVE-2016-0781

References for CVE-2016-0781

Products affected by CVE-2016-0781