Read the docs

Spring by Pivotal

Records146All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical30CVSS 9.0–10.0
CVSS high64CVSS 7.0–8.9

Exploited now

Spring by Pivotal records in CISA KEV
TI-2018-01178 VMware Tanzu Spring Data Commons Property Binder Vulnerability Priority CRITICAL 100KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records
Cloud Foundry Uaa 32 records MEDIUM Cloud Foundry Elastic Runtime 28 records MEDIUM Rabbitmq 11 records MEDIUM Cloud Foundry 10 records MEDIUM Operations Manager 10 records MEDIUM Spring Framework 10 records HIGH Cloud Foundry Uaa-release 8 records MEDIUM Concourse 7 records MEDIUM

Records

8 records in Cloud Foundry Uaa-release · all components

TI-2019-02801 CVE-2019-3787 · GHSA-7rf4-2hjj-cg48

UAA defaults email address to an insecure domain

Priority MEDIUM 40

Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01102 Published 2019-06-19 Fixed in v73.0.0 CWE-840
TI-2018-01107 CVE-2018-1192 · GHSA-xg5v-696h-c3vr

Information disclosure in Cloud Foundry Foundation cf-release versions prior to v285…

Priority MEDIUM 40

In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01015 Published 2018-02-01 Fixed in 4.5.5, 4.7.4 +1 CWE-200
TI-2017-03088 CVE-2017-4963 · GHSA-v3fx-g84p-g838

Session fixation in Cloud Foundry Foundation

Priority LOW 37

An issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier versions, UAA stand-alone release v2.0.0 - v2.7.4.12 & v3.0.0 - v3.11.0, and UAA bosh release v26 & earlier versions.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.009 Published 2017-06-13 No fix listed CWE-384
TI-2018-07829 CVE-2018-11041 · GHSA-xh4m-99qp-w483

Open redirect in Cloud Foundry UAA

Priority LOW 29

Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form pa…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00837 Published 2018-06-25 Fixed in 4.7.5, 4.10.1 +2 CWE-601
TI-2016-04335 CVE-2016-5016 · GHSA-rc2r-w8jv-vggp

Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server)…

Priority LOW 28

Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elasti…

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.01032 Published 2017-04-24 Fixed in 3.3.0.3, 3.4.2 CWE-295
TI-2019-08426 CVE-2019-11268 · GHSA-j3cm-76qq-2qmp

UAA SQL Identity Zone Vulnerability

Priority LOW 22

Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00987 Published 2019-07-11 Fixed in v73.3.0 CWE-200
Open these records in search →