CVE-2016-0781: Cloudfoundry Cloud Foundry Uaa Bosh

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions prior to 1.6.20 are vulnerable to an XSS attack by specifying malicious java script content in either the OAuth scopes (SCIM groups) or SCIM group descriptions.

Affected products

• Cloudfoundry Cloud Foundry Uaa Bosh: version 2 only; version 3 only; version 4 only; version 5 only; version 6 only; version 7 only
• Pivotal Software Cloud Foundry: version 208 only; version 209 only; version 210 only; version 211 only; version 212 only; version 213 only; …
• Pivotal Software Cloud Foundry Elastic Runtime: version 1.6.0 only; version 1.6.1 only; version 1.6.2 only; version 1.6.3 only; version 1.6.4 only; version 1.6.5 only; …
• Pivotal Software Cloud Foundry Uaa: up to and including 2.7.4.1; version 3.0.0 only; version 3.0.1 only; version 3.1.0 only; version 3.2.0 only
• Pivotal Software Login-Server: affected versions not specified

Published 2017-05-25. Last modified 2026-06-17.