QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2016-3084

Back to search

CVE-2016-3084

Published: May 25, 2017

Modified: Aug 5, 2024

PUBLISHED

Description

The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

VendorProductVersions

Pivotal

Cloud Foundry

affected
release v236 and earlier versions
affected
UAA release v3.3.0 and earlier versions
affected
All versions of Login-server
affected
UAA release v10 and earlier versions
affected
Elastic Runtime versions prior to 1.7.2

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now