CVE-2016-3084

State: Published
Severity: Not scored
Published: May 25, 2017
Updated: Aug 5, 2024
Reserved: Mar 10, 2016

Description

The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Cloud FoundryPivotal	release v236 and earlier versionsAffected UAA release v3.3.0 and earlier versionsAffected All versions of Login-serverAffected UAA release v10 and earlier versionsAffected Elastic Runtime versions prior to 1.7.2Affected

References

https://pivotal.io/security/cve-2016-3084

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.