{"schemaVersion":3,"id":"CVE-2016-0713","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Gorouter in Cloud Foundry cf-release v141 through v228 allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks via vectors related to modified requests.","dates":{"published":"2017-08-31T14:00:00.000Z","modified":"2024-08-05T22:30:03.569Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.7,"severity":"medium","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":4.7,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":2.6,"severity":"low","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00541,"percentile":0.4435,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00541},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00702,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00541,"percentile":0.4435}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00702,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00541,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00541,"percentile":0.4435}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"cloudfoundry","product":"cf-release","name":"cf-release","label":"cf-release","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"141","noFixRecorded":false,"fixedIn":null},{"text":"142","noFixRecorded":false,"fixedIn":null},{"text":"143","noFixRecorded":false,"fixedIn":null},{"text":"144","noFixRecorded":false,"fixedIn":null},{"text":"145","noFixRecorded":false,"fixedIn":null},{"text":"146","noFixRecorded":false,"fixedIn":null},{"text":"147","noFixRecorded":false,"fixedIn":null},{"text":"148","noFixRecorded":false,"fixedIn":null},{"text":"149","noFixRecorded":false,"fixedIn":null},{"text":"150","noFixRecorded":false,"fixedIn":null},{"text":"151","noFixRecorded":false,"fixedIn":null},{"text":"152","noFixRecorded":false,"fixedIn":null},{"text":"153","noFixRecorded":false,"fixedIn":null},{"text":"154","noFixRecorded":false,"fixedIn":null},{"text":"155","noFixRecorded":false,"fixedIn":null},{"text":"156","noFixRecorded":false,"fixedIn":null},{"text":"157","noFixRecorded":false,"fixedIn":null},{"text":"158","noFixRecorded":false,"fixedIn":null},{"text":"159","noFixRecorded":false,"fixedIn":null},{"text":"160","noFixRecorded":false,"fixedIn":null},{"text":"161","noFixRecorded":false,"fixedIn":null},{"text":"162","noFixRecorded":false,"fixedIn":null},{"text":"163","noFixRecorded":false,"fixedIn":null},{"text":"164","noFixRecorded":false,"fixedIn":null},{"text":"165","noFixRecorded":false,"fixedIn":null},{"text":"166","noFixRecorded":false,"fixedIn":null},{"text":"167","noFixRecorded":false,"fixedIn":null},{"text":"168","noFixRecorded":false,"fixedIn":null},{"text":"169","noFixRecorded":false,"fixedIn":null},{"text":"170","noFixRecorded":false,"fixedIn":null},{"text":"171","noFixRecorded":false,"fixedIn":null},{"text":"172","noFixRecorded":false,"fixedIn":null},{"text":"173","noFixRecorded":false,"fixedIn":null},{"text":"174","noFixRecorded":false,"fixedIn":null},{"text":"175","noFixRecorded":false,"fixedIn":null},{"text":"176","noFixRecorded":false,"fixedIn":null},{"text":"177","noFixRecorded":false,"fixedIn":null},{"text":"178","noFixRecorded":false,"fixedIn":null},{"text":"179","noFixRecorded":false,"fixedIn":null},{"text":"180","noFixRecorded":false,"fixedIn":null},{"text":"181","noFixRecorded":false,"fixedIn":null},{"text":"182","noFixRecorded":false,"fixedIn":null},{"text":"183","noFixRecorded":false,"fixedIn":null},{"text":"184","noFixRecorded":false,"fixedIn":null},{"text":"185","noFixRecorded":false,"fixedIn":null},{"text":"186","noFixRecorded":false,"fixedIn":null},{"text":"187","noFixRecorded":false,"fixedIn":null},{"text":"188","noFixRecorded":false,"fixedIn":null},{"text":"189","noFixRecorded":false,"fixedIn":null},{"text":"190","noFixRecorded":false,"fixedIn":null},{"text":"191","noFixRecorded":false,"fixedIn":null},{"text":"192","noFixRecorded":false,"fixedIn":null},{"text":"193","noFixRecorded":false,"fixedIn":null},{"text":"194","noFixRecorded":false,"fixedIn":null},{"text":"195","noFixRecorded":false,"fixedIn":null},{"text":"196","noFixRecorded":false,"fixedIn":null},{"text":"197","noFixRecorded":false,"fixedIn":null},{"text":"198","noFixRecorded":false,"fixedIn":null},{"text":"199","noFixRecorded":false,"fixedIn":null},{"text":"200","noFixRecorded":false,"fixedIn":null},{"text":"201","noFixRecorded":false,"fixedIn":null},{"text":"202","noFixRecorded":false,"fixedIn":null},{"text":"203","noFixRecorded":false,"fixedIn":null},{"text":"204","noFixRecorded":false,"fixedIn":null},{"text":"205","noFixRecorded":false,"fixedIn":null},{"text":"206","noFixRecorded":false,"fixedIn":null},{"text":"207","noFixRecorded":false,"fixedIn":null},{"text":"208","noFixRecorded":false,"fixedIn":null},{"text":"209","noFixRecorded":false,"fixedIn":null},{"text":"210","noFixRecorded":false,"fixedIn":null},{"text":"211","noFixRecorded":false,"fixedIn":null},{"text":"212","noFixRecorded":false,"fixedIn":null},{"text":"213","noFixRecorded":false,"fixedIn":null},{"text":"214","noFixRecorded":false,"fixedIn":null},{"text":"215","noFixRecorded":false,"fixedIn":null},{"text":"216","noFixRecorded":false,"fixedIn":null},{"text":"217","noFixRecorded":false,"fixedIn":null},{"text":"218","noFixRecorded":false,"fixedIn":null},{"text":"219","noFixRecorded":false,"fixedIn":null},{"text":"220","noFixRecorded":false,"fixedIn":null},{"text":"221","noFixRecorded":false,"fixedIn":null},{"text":"222","noFixRecorded":false,"fixedIn":null},{"text":"223","noFixRecorded":false,"fixedIn":null},{"text":"224","noFixRecorded":false,"fixedIn":null},{"text":"225","noFixRecorded":false,"fixedIn":null},{"text":"226","noFixRecorded":false,"fixedIn":null},{"text":"227","noFixRecorded":false,"fixedIn":null},{"text":"228","noFixRecorded":false,"fixedIn":null}],"versionsText":"141 | 142 | 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | 168 | 169 | 170 | 171 | 172 | 173 | 174 | 175 | 176 | 177 | 178 | 179 | 180 | 181 | 182 | 183 | 184 | 185 | 186 | 187 | 188 | 189 | 190 | 191 | 192 | 193 | 194 | 195 | 196 | 197 | 198 | 199 | 200 | 201 | 202 | 203 | 204 | 205 | 206 | 207 | 208 | 209 | 210 | 211 | 212 | 213 | 214 | 215 | 216 | 217 | 218 | 219 | 220 | 221 | 222 | 223 | 224 | 225 | 226 | 227 | 228","eol":null,"hubHref":"/vendor/cloudfoundry/cf-release"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://lists.cloudfoundry.org/archives/list/cf-dev%40lists.cloudfoundry.org/thread/VWDLUNTDKW5CW5JWEM5BOHLJ3J32TAFF/","label":"lists.cloudfoundry.org/archives/…","hostname":"lists.cloudfoundry.org","tags":["Mailing List","X Refsource MLIST"]},{"url":"https://bosh.io/releases/github.com/cloudfoundry/cf-release?version=229","label":"bosh.io/releases/github.com/cloudfoundry/cf-release?version=229","hostname":"bosh.io","tags":["X Refsource CONFIRM","Release Notes","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2017-08-31T14:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-05T22:30:03.569Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":19,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T22:29:54.326Z","stale":false,"partial":false}}