Vulnerability Details : CVE-2016-5016
Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.
Products affected by CVE-2016-5016
- Pivotal Software » Cloud Foundry Elastic RuntimeVersions from including (>=) 1.7.0 and before (<) 1.7.13cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:*:*:*:*:*:*:*:*
- Pivotal Software » Cloud Foundry Elastic RuntimeVersions from including (>=) 1.6.0 and before (<) 1.6.35cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:*:*:*:*:*:*:*:*
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*
- cpe:2.3:a:pivotal_software:cloud_foundry:*:*:*:*:*:*:*:*
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa-release:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-5016
0.28%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 48 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-5016
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
5.9
|
MEDIUM | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
2.2
|
3.6
|
NIST |
CWE ids for CVE-2016-5016
-
The product does not validate, or incorrectly validates, a certificate.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-5016
-
https://github.com/cloudfoundry/uaa-release/releases/tag/v11.3
Release Updated to UAA 3.3.0.3 · cloudfoundry/uaa-release · GitHubRelease Notes;Third Party Advisory
-
https://github.com/cloudfoundry/uaa/releases/tag/3.4.2
Release UAA 3.4.2 - Security Release (CVE-2016-5016) · cloudfoundry/uaa · GitHubRelease Notes;Third Party Advisory
-
https://pivotal.io/security/cve-2016-5016
CVE-2016-5016 UAA accepts expired certificates | Security | PivotalVendor Advisory
-
https://github.com/cloudfoundry/uaa/releases/tag/2.7.4.6
Release UAA 2.7.4.6 - Security Release (CVE-2016-5016) · cloudfoundry/uaa · GitHubRelease Notes;Third Party Advisory
-
https://github.com/cloudfoundry/cf-release/releases/tag/v240
Release v240 · cloudfoundry-attic/cf-release · GitHubRelease Notes;Third Party Advisory
-
https://github.com/cloudfoundry/uaa/releases/tag/3.3.0.3
Release UAA 3.3.0.3 - Security Release (CVE-2016-5016) · cloudfoundry/uaa · GitHubRelease Notes;Third Party Advisory
-
https://github.com/cloudfoundry/uaa-release/releases/tag/v12.3
Release Updated to UAA 3.4.2 · cloudfoundry/uaa-release · GitHubRelease Notes;Third Party Advisory
Jump to