CVE-2016-2165

MEDIUM

cf-release < 231 and Elastic Runtime < 1.5.19/1.6.20 - Cross-Site Scripting via Loggregator Traffic Controller

Title source: llm
STIX 2.1

Description

The Loggregator Traffic Controller endpoints in cf-release v231 and lower, Pivotal Elastic Runtime versions prior to 1.5.19 AND 1.6.x versions prior to 1.6.20 are not cleansing request URL paths when they are invalid and are returning them in the 404 response. This could allow malicious scripts to be written directly into the 404 response.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
https://pivotal.io/security/cve-2016-2165

Scores

CVSS v3 6.5
EPSS 0.0086
EPSS Percentile 54.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Details

CWE
CWE-20
Status published
Products (24)
cloudfoundry/cf-release < 231
Pivotal/Cloud Foundry Elastic Runtime versions prior to 1.5.19 AND 1.6.x versions prior to 1.6.20
Pivotal/Cloud Foundry cf-release v231 and lower
pivotal_software/cloud_foundry_elastic_runtime 1.6.0
pivotal_software/cloud_foundry_elastic_runtime 1.6.1
pivotal_software/cloud_foundry_elastic_runtime 1.6.2
pivotal_software/cloud_foundry_elastic_runtime 1.6.3
pivotal_software/cloud_foundry_elastic_runtime 1.6.4
pivotal_software/cloud_foundry_elastic_runtime 1.6.5
pivotal_software/cloud_foundry_elastic_runtime 1.6.6
... and 14 more
Published May 25, 2017
Tracked Since Feb 18, 2026