Brute Force Vulnerability in Cloud Foundry's User Authentication

CVE-2016-3084

What is CVE-2016-3084?

The reset password flow in Cloud Foundry's User Account and Authentication (UAA) service is susceptible to brute force attacks, allowing multiple active reset codes simultaneously. This specifically affects deployments using the UAA's internal user store for authentication, creating a risk for users trying to reset their passwords. Integrations utilizing external authentication methods like SAML or LDAP are not subject to this vulnerability.

References