CVE-2016-5016

Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.

• CWE-295

• https://github.com/cloudfoundry/cf-release/releases/tag/v240Release Notes, Third Party Advisory
• https://github.com/cloudfoundry/uaa-release/releases/tag/v11.3Release Notes, Third Party Advisory
• https://github.com/cloudfoundry/uaa-release/releases/tag/v12.3Release Notes, Third Party Advisory
• https://github.com/cloudfoundry/uaa/releases/tag/2.7.4.6Release Notes, Third Party Advisory
• https://github.com/cloudfoundry/uaa/releases/tag/3.3.0.3Release Notes, Third Party Advisory
• https://github.com/cloudfoundry/uaa/releases/tag/3.4.2Release Notes, Third Party Advisory
• https://pivotal.io/security/cve-2016-5016Vendor Advisory
• https://github.com/cloudfoundry/cf-release/releases/tag/v240Release Notes, Third Party Advisory
• https://github.com/cloudfoundry/uaa-release/releases/tag/v11.3Release Notes, Third Party Advisory
• https://github.com/cloudfoundry/uaa-release/releases/tag/v12.3Release Notes, Third Party Advisory
• https://github.com/cloudfoundry/uaa/releases/tag/2.7.4.6Release Notes, Third Party Advisory
• https://github.com/cloudfoundry/uaa/releases/tag/3.3.0.3Release Notes, Third Party Advisory
• https://github.com/cloudfoundry/uaa/releases/tag/3.4.2Release Notes, Third Party Advisory
• https://pivotal.io/security/cve-2016-5016Vendor Advisory

Published

Apr 24, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-5010coders/tiff.c in ImageMagick before 6.9.5-3 allows remote at…
• CVE-2016-5011The parse_dos_extended function in partitions/dos.c in the l…4.6
• CVE-2016-5012In Moodle 3.x, glossary search displays entries without chec…
• CVE-2016-5013In Moodle 2.x and 3.x, text injection can occur in email hea…
• CVE-2016-5014In Moodle 2.x and 3.x, an unenrolled user still receives eve…
• CVE-2016-5015Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-5017Buffer overflow in the C cli shell in Apache Zookeeper befor…
• CVE-2016-5018In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0…9.1
• CVE-2016-5019CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 th…
• CVE-2016-5020F5 BIG-IP before 12.0.0 HF3 allows remote authenticated user…
• CVE-2016-5021The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analyt…
• CVE-2016-5022F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2…