Vulnerability Report

CVE-2016-2165

Title: Pivotal Software Cloud Foundry Elastic Runtime Improper Input Validation

Input Validation Error

Proof Of Concept

No public PoC currently indexed for CVE-2016-2165.

CWE Category CWE-20

Published Date May 25, 2017

Modified Date May 13, 2026

Exploit Status Not Found

Score 6.5 CVSS v3.1

Exploit Probability (EPSS)

0.26%

Vulnerability Summary

CVE-2016-2165: The Loggregator Traffic Controller endpoints in cf-release v231 and lower, Pivotal Elastic Runtime versions prior to 1.5.19 AND 1.6.x versions prior to 1.6.20 are not cleansing request URL paths when they are invalid and are returning them in the 404 response. This could allow malicious scripts to be written directly into the 404 response.

Impacted Vendors

pivotal_software 1

pivotal 1

cloudfoundry 1

Reference Links

https://pivotal.io/security/cve-2016-2165 https://pivotal.io/security/cve-2016-2165

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

6.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

4.3

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:N/C:N/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns