CVE-2016-5016

low-risk

Published 2017-04-24

Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.

Do I need to act?

0.28% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.9/10 Medium

NETWORK / HIGH complexity

Affected Products (4)

Cloud Foundry

Cloud Foundry Uaa

Cloud Foundry Elastic Runtime

Cloud Foundry Uaa-Release

Affected Vendors

Pivotal Software

References (14)

Release Notes https://github.com/cloudfoundry/cf-release/releases/tag/v240

Release Notes https://github.com/cloudfoundry/uaa-release/releases/tag/v11.3

Release Notes https://github.com/cloudfoundry/uaa-release/releases/tag/v12.3

Release Notes https://github.com/cloudfoundry/uaa/releases/tag/2.7.4.6

Release Notes https://github.com/cloudfoundry/uaa/releases/tag/3.3.0.3

Release Notes https://github.com/cloudfoundry/uaa/releases/tag/3.4.2

Vendor Advisory https://pivotal.io/security/cve-2016-5016

Release Notes https://github.com/cloudfoundry/cf-release/releases/tag/v240

Release Notes https://github.com/cloudfoundry/uaa-release/releases/tag/v11.3

Release Notes https://github.com/cloudfoundry/uaa-release/releases/tag/v12.3

Release Notes https://github.com/cloudfoundry/uaa/releases/tag/2.7.4.6

Release Notes https://github.com/cloudfoundry/uaa/releases/tag/3.3.0.3

Release Notes https://github.com/cloudfoundry/uaa/releases/tag/3.4.2

Vendor Advisory https://pivotal.io/security/cve-2016-5016

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 10/34 · Low