CVE-2016-0781 — Cross-site Scripting in Software Cloud Foundry UAA

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.3%
top 49.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Pivotal Software Cloud Foundry UAAPivotal Cloud FoundryCloudfoundry Cloud Foundry UAA Bosh+2 more
Timeline
PublishedMay 25
Latest updateMay 13

Description

The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions prior to 1.6.20 are vulnerable to an XSS attack by specifying malicious java script content in either the OAuth scopes (SCIM groups) or SCIM group descriptions.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages5 packages

▶CVEListV5pivotal/cloud_foundry6 versions+5
▶NVDpivotal_software/cloud_foundry25 versions+24

🔴Vulnerability Details

2
GHSA
GHSA-cfh6-j4mw-8cx7: The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1↗2022-05-13
▶
CVEList
CVE-2016-0781: The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1↗2017-05-25
▶
CVE-2016-0781 — Cross-site Scripting | cvebase