Design/Logic Flaw

2017-05-2517:29:00

PRIOn knowledge base

www.prio-n.com

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.5%

JSON

The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions prior to 1.6.20 are vulnerable to an XSS attack by specifying malicious java script content in either the OAuth scopes (SCIM groups) or SCIM group descriptions.

CPENameOperatorVersion
cloud_foundry_uaa_bosheq6
cloud_foundry_uaa_bosheq7
cloud_foundry_uaa_bosheq4
cloud_foundry_uaa_bosheq5
cloud_foundry_uaa_bosheq2
cloud_foundry_uaa_bosheq3
cloud_foundryeq231
cloud_foundryeq241
cloud_foundryeq211
cloud_foundryeq209

Name	Operator	Version
cloud_foundry_uaa_bosh	eq	6
cloud_foundry_uaa_bosh	eq	7
cloud_foundry_uaa_bosh	eq	4
cloud_foundry_uaa_bosh	eq	5
cloud_foundry_uaa_bosh	eq	2
cloud_foundry_uaa_bosh	eq	3
cloud_foundry	eq	231
cloud_foundry	eq	241
cloud_foundry	eq	211
cloud_foundry	eq	209

Rows per page:

1-10 of 561

References

pivotal.io/security/cve-2016-0781