Vulnerability CVE-2016-0781
Published: 2017-05-25

Description:
The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions prior to 1.6.20 are vulnerable to an XSS attack by specifying malicious java script content in either the OAuth scopes (SCIM groups) or SCIM group descriptions.

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Pivotal software -> Cloud foundry 
Pivotal software -> Cloud foundry uaa 
Pivotal software -> Cloud foundry elastic runtime 
Pivotal software -> Cloud foundry uaa release 
Pivotal software -> Login-server 

 References:
https://pivotal.io/security/cve-2016-0781
Copyright 2024, cxsecurity.com

 

Back to Top