{"id":"CVE-2016-3084","aliases":["EUVD-2022-3804","GHSA-fm5c-2rwc-887w"],"status":"published","title":"Cloud Foundry UAA reset password vulnerable to brute force attack","description":"The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0119,"percentile":0.68153,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2017-05-25T17:00:00Z","modified":"2026-10-24T10:30:32Z","fixes":[{"ecosystem":"Maven","package":"org.cloudfoundry.identity:cloudfoundry-identity-server","fixed_in":["3.3.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.cloudfoundry.identity:cloudfoundry-identity-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.cloudfoundry.identity:cloudfoundry-identity-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0.1"}]}],"versions":["3.0.0","3.0.1","3.1.0","3.2.0","3.2.1","3.3.0"]}],"products":[{"vendor":"cloudfoundry","product":"cloud foundry"},{"vendor":"cloudfoundry","product":"cloud_foundry_uaa_bosh"},{"vendor":"pivotal","product":"cloud foundry"},{"vendor":"pivotal_software","product":"cloud_foundry"},{"vendor":"pivotal_software","product":"cloud_foundry_elastic_runtime"},{"vendor":"pivotal_software","product":"cloud_foundry_uaa"},{"vendor":"pivotal_software","product":"login-server"}],"references":[{"url":"https://pivotal.io/security/cve-2016-3084","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3084","tags":["advisory"]},{"url":"https://github.com/cloudfoundry/uaa/commit/14350228989e2aee900b8d48a848293bb5152b6f","tags":["web"]},{"url":"https://github.com/cloudfoundry/uaa/commit/1d3ad7399d010f6a29dc3bf8139d792121301ab8","tags":["web"]},{"url":"https://github.com/cloudfoundry/uaa/commit/460627ed419e4227b10ff121248b3ffc009011a9","tags":["web"]},{"url":"https://github.com/cloudfoundry/uaa/commit/4a119d314744460ed56bcd740b2e913bf3f560c1","tags":["web"]},{"url":"https://github.com/cloudfoundry/uaa/commit/5c2377487bef9d716d5c8e5717df1fc00bc7b000","tags":["web"]},{"url":"https://github.com/cloudfoundry/uaa/commit/66132926f1bac0b878da5841be2f93fa5075d88f","tags":["web"]},{"url":"https://github.com/cloudfoundry/uaa/commit/b3834364ab573e9655348193780a56a602fe87b7","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fm5c-2rwc-887w"},{"url":"https://github.com/cloudfoundry/uaa","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2016-3084","description":"The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.","status":"published","published":"2017-05-25T17:00:00Z","modified":"2024-08-05T23:40:15.665Z","updated_at":"2026-11-02T14:33:34.094161Z"}],"euvd":[{"id":"EUVD-2022-3804","description":"The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.","status":"published","published":"2017-05-25T17:00:00Z","modified":"2024-08-05T23:40:15Z","updated_at":"2026-11-03T02:22:51.132305Z"}],"ghsa":[{"id":"GHSA-fm5c-2rwc-887w","title":"Cloud Foundry UAA reset password vulnerable to brute force attack","description":"The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.","status":"published","published":"2022-05-13T01:07:24Z","modified":"2024-02-28T22:07:56Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:37:38.935144Z"}],"nvd":[{"id":"CVE-2016-3084","description":"The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.","status":"published","published":"2017-05-25T17:29:00.63Z","modified":"2026-06-17T00:44:56.34Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:38.290327Z"}],"osv":[{"id":"CVE-2016-3084","description":"The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.","status":"published","published":"2017-05-25T17:29:00.63Z","modified":"2026-10-24T10:30:32.870992808Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"GHSA-fm5c-2rwc-887w","title":"Cloud Foundry UAA reset password vulnerable to brute force attack","description":"The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.","status":"published","published":"2022-05-13T01:07:24Z","modified":"2024-12-05T05:26:00.892482Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:46.760785Z"}]}}