Read the docs
TI-2016-04335 Aliases CVE-2016-5016GHSA-rc2r-w8jv-vggp

Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server)…

Priority LOW 28CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-295.

Summary

Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.

Why it matters now

EPSS 0.01032 63rd percentileScored 2026-11-07
Fix Fixed org.cloudfoundry.identity:cloudfoundry-identity-server (Maven): 3.3.0.3, 3.4.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.cloudfoundry.identity:cloudfoundry-identity-server (Maven)3.0.0 to before 3.3.0.33.3.0.3Patch availableGHSA-rc2r-w8jv-vggp
—org.cloudfoundry.identity:cloudfoundry-identity-server (Maven)3.4.0 to before 3.4.23.4.2Patch availableGHSA-rc2r-w8jv-vggp
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Vendor— Affected 3.0.0 to before 3.3.0.3 Fixed in 3.3.0.3 Patch available GHSA-rc2r-w8jv-vggp
  • org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Vendor— Affected 3.4.0 to before 3.4.2 Fixed in 3.4.2 Patch available GHSA-rc2r-w8jv-vggp

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:pivotal_software:cloud_foundry:*:*:*:*:*:*:*:*up to 239VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:*:*:*:*:*:*:*:*1.6.0 to before 1.6.35; 1.7.0 to before 1.7.13VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*up to 3.4.1VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa-release:*:*:*:*:*:*:*:*up to 12.2VulnerableSpring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry:*:*:*:*:*:*:*:* Versions up to 239 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:*:*:*:*:*:*:*:* Versions 1.6.0 to before 1.6.35; 1.7.0 to before 1.7.13 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:* Versions up to 3.4.1 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa-release:*:*:*:*:*:*:*:* Versions up to 12.2 Vulnerable ·Spring by Pivotal

Remediation

  • Fix · GHSA-rc2r-w8jv-vggp org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Fixed in 3.3.0.3 Advisory →
  • Fix · GHSA-rc2r-w8jv-vggp org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Fixed in 3.4.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-5016
  2. 2026-10-03 Alias added: GHSA-rc2r-w8jv-vggp

References

Advisory 8

Other 3

  • TI-2016-04326 The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at… CVSS 3.0CRITICAL 9.8
  • TI-2016-05699 The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before… CVSS 3.0HIGH 8.8
  • TI-2016-05687 Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF)… CVSS 3.0CRITICAL 9.6
  • TI-2016-03841 SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before… CVSS 3.0HIGH 8.8
  • TI-2016-05706 Improper authentication in Cloud Foundry v247 and earlier and UAA v3.9.2 & earlier and… CVSS 3.0HIGH 8.1
  • TI-2016-02583 Access control flaw in Pivotal Cloud Foundry CVSS 3.0HIGH 8.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences