Read the docs

CloudFoundry Foundation

Records118All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical11CVSS 9.0–10.0
CVSS high64CVSS 7.0–8.9

Exploited now

CloudFoundry Foundation records in CISA KEV

No CloudFoundry Foundation vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Cf-deployment 37 records MEDIUM Cf-release 35 records MEDIUM Capi-release 22 records MEDIUM Cloud Foundry Uaa Bosh 15 records MEDIUM User Account And Authentication 9 records MEDIUM Routing-release 8 records MEDIUM Routing Release 5 records LOW Uaa Release 5 records MEDIUM

Records

5 records in Uaa Release · all components

TI-2019-02813 CVE-2019-3801 · GHSA-4w8g-vwqf-w48w

Java Projects using HTTP to fetch dependencies

Priority MEDIUM 43

Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00588 Published 2019-04-25 Fixed in 2.1.3, 1.9.10 +4 CWE-494
TI-2019-08437 CVE-2019-11279 · GHSA-272q-hvx6-q97c

Privilege Escalation via Scope Manipulation in UAA

Priority MEDIUM 41

CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0133 Published 2019-09-26 Fixed in 74.1.0 CWE-77
TI-2019-02802 CVE-2019-3788 · GHSA-qf8p-gpw6-r52g

UAA redirect-uri allows wildcard in the subdomain

Priority LOW 39

Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri.

CVSS 3.0HIGH 8.7 Network No auth No interaction EPSS 0.00832 Published 2019-04-25 Fixed in v71.0, 2.5.1 CWE-601
TI-2019-02789 CVE-2019-3775 · GHSA-hwg9-rc2h-c2p3

UAA allows users to modify their own email address

Priority LOW 33

Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address.

CVSS 3.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00876 Published 2019-03-07 Fixed in v70.0 CWE-290
TI-2025-16156 CVE-2025-22246 · GHSA-f42p-pxc9-254g

CVE-2025-22246 – UAA Private Key Exposure

Priority LOW 32

Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00204 Published 2025-05-13 Fixed CWE-532
Open these records in search →