CVE-2016-3084 Cloud Foundry UAA reset password vulnerable to brute force attack

What is CVE-2016-3084?

CVE-2016-3084 is a high-severity vulnerability in Pivotal Cloud Foundry, published on 25 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

Weakness: CWE-264

Which versions are affected by CVE-2016-3084?

2 open source packages ship an affected version, including org.cloudfoundry.identity:cloudfoundry-identity-server. It affects 5 products.

Products include Cloudfoundry Cloud Foundry Uaa Bosh, Pivotal Software Cloud Foundry, Pivotal Software Cloud Foundry Elastic Runtime, Pivotal Software Cloud Foundry Uaa, Pivotal Software Login-Server.

How do I fix CVE-2016-3084?

Upgrade org.cloudfoundry.identity:cloudfoundry-identity-server to 3.3.0.1 or later.

Is CVE-2016-3084 being exploited?

There is no known exploitation of CVE-2016-3084 in the wild and no public exploit code.

Other vulnerabilities in Pivotal Cloud Foundry

• CVE-2016-6637 Cloud Foundry vulnerable to Cross-Site Request Forgery Critical 9.6
• CVE-2017-4973 Cloud Foundry UAA Privilege Escalation High 8.8
• CVE-2016-4468 SQL injection in n/a High 8.8
• CVE-2016-6651 Privilege escalation in n/a High 8.8
• CVE-2016-6659 Privilege escalation in Cloud Foundry v247 and earlier and UAA v3.9.2 & earlier and UAA bosh (uaa-release) v23 & earlier High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fm5c-2rwc-887w.