GHSA-fm5c-2rwc-887w CVE-2016-3084

Cloud Foundry UAA reset password vulnerable to brute force attack

High Maven

Severity: 8.1 / 10; High · CVSS 3.0
Exploit chance (EPSS): 1.19%; Chance of exploitation in the next 30 days. Higher than 67.96% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 3.3.0.1; Upgrade org.cloudfoundry.identity:cloudfoundry-identity-server to this version or later

Description

The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

Affected versions

Maven

Package	Vulnerable	Fixed in
org.cloudfoundry.identity:cloudfoundry-identity-server	`< 3.3.0.1`	`3.3.0.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.cloudfoundry.identity:cloudfoundry-identity-server Maven → `3.3.0.1`

maven

<dependency><groupId>org.cloudfoundry.identity</groupId><artifactId>cloudfoundry-identity-server</artifactId><version>3.3.0.1</version></dependency>

gradle

implementation("org.cloudfoundry.identity:cloudfoundry-identity-server:3.3.0.1")

Severity breakdown

CVSS 3.0 8.1

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2016-3084

Packages

github.com/cloudfoundry/uaa

Timeline

May 13, 2022 Published
Dec 5, 2024 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-6wcw-r64p-qrrw Cloudfoundry UAA has logic error in the token revocation endpoint implementation	Medium	Also affects org.cloudfoundry.identity:cloudfoundry-identity-server
GHSA-xg5v-696h-c3vr Cloud Foundry UAA SessionID present in Audit Event Logs	High	Also affects org.cloudfoundry.identity:cloudfoundry-identity-server
GHSA-xh4m-99qp-w483 Cloud Foundry UAA open redirect	Medium	Also affects org.cloudfoundry.identity:cloudfoundry-identity-server
GHSA-rc2r-w8jv-vggp Cloud Foundry vulnerable to Improper Certificate Validation	Medium	Also affects org.cloudfoundry.identity:cloudfoundry-identity-server
GHSA-r4v8-9hgx-vm6m Cloud Foundry UAA accepts refresh token as access token on admin endpoints	High	Also affects org.cloudfoundry.identity:cloudfoundry-identity-server
GHSA-292x-hjr8-226f Cloud Foundry UAA Privilege Escalation	High	Also affects org.cloudfoundry.identity:cloudfoundry-identity-server
GHSA-j97q-9xp9-g5fx Pivotal Cloud Foundry UAA XSS on UAA OpenID Connect check session iframe endpoint	Medium	Also affects org.cloudfoundry.identity:cloudfoundry-identity-server
GHSA-j4p3-2m2h-cv5f Cloud Foundry UAA Denial of Service through client token revocation endpoint	Medium	Also affects org.cloudfoundry.identity:cloudfoundry-identity-server

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor