Skip to content
Fencer Vulns
medium 5.9

CVE-2016-5016 json

Cloud Foundry vulnerable to Improper Certificate Validation

published 2017-04-24 9 y ago modified 2026-06-17 4 mo ago also GHSA-rc2r-w8jv-vggp , EUVD-2022-5144

cvss
5.9
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits
0
none known

Summary

Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.

Patch / fix

  • maven org.cloudfoundry.identity:cloudfoundry-identity-server 3.3.0.3, 3.4.2
  • pivotal_software cloud_foundry_elastic_runtime 1.6.35, 1.7.13

Exploit prediction

1.03% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.cloudfoundry.identity:cloudfoundry-identity-server
>=3.0.0, <3.3.0.3
>=3.4.0, <3.4.2
3.3.0.3
3.4.2

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.