Read the docs
TI-2016-00699 Aliases CVE-2016-0781GHSA-cfh6-j4mw-8cx7

Cross-site scripting in Pivotal Cloud Foundry

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions prior to 1.6.20 are vulnerable to an XSS attack by specifying malicious java script content in either the OAuth scopes (SCIM groups) or SCIM group descriptions.

Why it matters now

EPSS 0.00656 51st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PivotalCloud Foundryv208 to v231; Login-server v1.6 to v1.14; UAA v2.0.0 to v2.7.4.1; UAA v3.0.0 to v3.2.0; UAA-Release v2 to v7; Elastic Runtime 1.6.x versions prior to 1.6.20—No fix listedCNA
  • Cloud Foundry VendorPivotal Affected v208 to v231; Login-server v1.6 to v1.14; UAA v2.0.0 to v2.7.4.1; UAA v3.0.0 to v3.2.0; UAA-Release v2 to v7; Elastic Runtime 1.6.x versions prior to 1.6.20 Fixed in — No fix listed CNA

CPE configurations NVD · 57

CPEVersionsRoleVendor
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:2:*:*:*:*:*:*:*2VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:3:*:*:*:*:*:*:*3VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:4:*:*:*:*:*:*:*4VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:5:*:*:*:*:*:*:*5VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:6:*:*:*:*:*:*:*6VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:7:*:*:*:*:*:*:*7VulnerableCloudFoundry Foundation
cpe:2.3:a:pivotal_software:cloud_foundry:208:*:*:*:*:*:*:*208VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:209:*:*:*:*:*:*:*209VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:210:*:*:*:*:*:*:*210VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:211:*:*:*:*:*:*:*211VulnerableSpring by Pivotal
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:2:*:*:*:*:*:*:* Versions 2 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:3:*:*:*:*:*:*:* Versions 3 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:4:*:*:*:*:*:*:* Versions 4 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:5:*:*:*:*:*:*:* Versions 5 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:6:*:*:*:*:*:*:* Versions 6 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:7:*:*:*:*:*:*:* Versions 7 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:pivotal_software:cloud_foundry:208:*:*:*:*:*:*:* Versions 208 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:209:*:*:*:*:*:*:* Versions 209 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:210:*:*:*:*:*:*:* Versions 210 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:211:*:*:*:*:*:*:* Versions 211 Vulnerable ·Spring by Pivotal
Show 47 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:pivotal_software:cloud_foundry:212:*:*:*:*:*:*:*212VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:213:*:*:*:*:*:*:*213VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:214:*:*:*:*:*:*:*214VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:215:*:*:*:*:*:*:*215VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:216:*:*:*:*:*:*:*216VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:217:*:*:*:*:*:*:*217VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:218:*:*:*:*:*:*:*218VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:219:*:*:*:*:*:*:*219VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:220:*:*:*:*:*:*:*220VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:221:*:*:*:*:*:*:*221VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:222:*:*:*:*:*:*:*222VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:223:*:*:*:*:*:*:*223VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:224:*:*:*:*:*:*:*224VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:225:*:*:*:*:*:*:*225VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:226:*:*:*:*:*:*:*226VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:227:*:*:*:*:*:*:*227VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:228:*:*:*:*:*:*:*228VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:229:*:*:*:*:*:*:*229VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:230:*:*:*:*:*:*:*230VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:231:*:*:*:*:*:*:*231VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry:241:*:*:*:*:*:*:*241VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.0:*:*:*:*:*:*:*1.6.0VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.1:*:*:*:*:*:*:*1.6.1VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.2:*:*:*:*:*:*:*1.6.2VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.3:*:*:*:*:*:*:*1.6.3VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.4:*:*:*:*:*:*:*1.6.4VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.5:*:*:*:*:*:*:*1.6.5VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.6:*:*:*:*:*:*:*1.6.6VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.7:*:*:*:*:*:*:*1.6.7VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.8:*:*:*:*:*:*:*1.6.8VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.9:*:*:*:*:*:*:*1.6.9VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.10:*:*:*:*:*:*:*1.6.10VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.11:*:*:*:*:*:*:*1.6.11VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.12:*:*:*:*:*:*:*1.6.12VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.13:*:*:*:*:*:*:*1.6.13VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.14:*:*:*:*:*:*:*1.6.14VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.15:*:*:*:*:*:*:*1.6.15VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.16:*:*:*:*:*:*:*1.6.16VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.17:*:*:*:*:*:*:*1.6.17VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.18:*:*:*:*:*:*:*1.6.18VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.19:*:*:*:*:*:*:*1.6.19VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*up to 2.7.4.1VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.0.1:*:*:*:*:*:*:*3.0.1VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:login-server:-:*:*:*:*:*:*:*not specified by NVDVulnerableSpring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:212:*:*:*:*:*:*:* Versions 212 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:213:*:*:*:*:*:*:* Versions 213 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:214:*:*:*:*:*:*:* Versions 214 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:215:*:*:*:*:*:*:* Versions 215 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:216:*:*:*:*:*:*:* Versions 216 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:217:*:*:*:*:*:*:* Versions 217 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:218:*:*:*:*:*:*:* Versions 218 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:219:*:*:*:*:*:*:* Versions 219 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:220:*:*:*:*:*:*:* Versions 220 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:221:*:*:*:*:*:*:* Versions 221 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:222:*:*:*:*:*:*:* Versions 222 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:223:*:*:*:*:*:*:* Versions 223 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:224:*:*:*:*:*:*:* Versions 224 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:225:*:*:*:*:*:*:* Versions 225 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:226:*:*:*:*:*:*:* Versions 226 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:227:*:*:*:*:*:*:* Versions 227 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:228:*:*:*:*:*:*:* Versions 228 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:229:*:*:*:*:*:*:* Versions 229 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:230:*:*:*:*:*:*:* Versions 230 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:231:*:*:*:*:*:*:* Versions 231 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:241:*:*:*:*:*:*:* Versions 241 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.2:*:*:*:*:*:*:* Versions 1.6.2 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.3:*:*:*:*:*:*:* Versions 1.6.3 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.4:*:*:*:*:*:*:* Versions 1.6.4 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.5:*:*:*:*:*:*:* Versions 1.6.5 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.6:*:*:*:*:*:*:* Versions 1.6.6 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.7:*:*:*:*:*:*:* Versions 1.6.7 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.8:*:*:*:*:*:*:* Versions 1.6.8 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.9:*:*:*:*:*:*:* Versions 1.6.9 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.10:*:*:*:*:*:*:* Versions 1.6.10 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.11:*:*:*:*:*:*:* Versions 1.6.11 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.12:*:*:*:*:*:*:* Versions 1.6.12 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.13:*:*:*:*:*:*:* Versions 1.6.13 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.14:*:*:*:*:*:*:* Versions 1.6.14 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.15:*:*:*:*:*:*:* Versions 1.6.15 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.16:*:*:*:*:*:*:* Versions 1.6.16 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.17:*:*:*:*:*:*:* Versions 1.6.17 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.18:*:*:*:*:*:*:* Versions 1.6.18 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:1.6.19:*:*:*:*:*:*:* Versions 1.6.19 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:* Versions up to 2.7.4.1 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:login-server:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Spring by Pivotal

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-0781
  2. 2026-10-03 Alias added: GHSA-cfh6-j4mw-8cx7
  3. 2026-10-13 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2017-05637 Improper input validation in Pivotal Spring Data REST and Spring Boot CVSS 3.0CRITICAL 9.8
  • TI-2016-04299 When processing authorization requests using the whitelabel views in Spring Security… CVSS 3.0HIGH 8.8
  • TI-2018-01165 Code injection in Pivotal Spring Security OAuth CVSS 3.0CRITICAL 9.8
  • TI-2018-11237 DoS Attack via Range Requests CVSS 3.1HIGH 7.5
  • TI-2019-02791 Apps Manager unverified SSL certs in Cloud Controller proxy CVSS 3.0CRITICAL 9.8
  • TI-2018-11239 On Demand Services SDK Timing Attack Vulnerability CVSS 3.0CRITICAL 9.8
See all 85 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences