Read the docs
TI-2017-03096 Aliases CVE-2017-4972GHSA-5w93-xgv6-rpgw

SQL injection in Cloud Foundry UAA

Priority LOW 35CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prior to v3.15.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.12, 24.x versions prior to v24.7, and other versions prior to v30. An attacker can use a blind SQL injection attack to query the contents of the UAA database.

Why it matters now

EPSS 0.01085 65th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Cloud Foundry UAACloud Foundry UAA—No fix listedCNA
  • Cloud Foundry UAA Vendor— Affected Cloud Foundry UAA Fixed in — No fix listed CNA

CPE configurations NVD · 62

CPEVersionsRoleVendor
cpe:2.3:a:cloudfoundry:cf-release:*:*:*:*:*:*:*:*up to 256VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:*:*:*:*:*:*:*:*up to 29VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.1:*:*:*:*:*:*:*13.1VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.2:*:*:*:*:*:*:*13.2VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.3:*:*:*:*:*:*:*13.3VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.4:*:*:*:*:*:*:*13.4VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.5:*:*:*:*:*:*:*13.5VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.6:*:*:*:*:*:*:*13.6VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.7:*:*:*:*:*:*:*13.7VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.8:*:*:*:*:*:*:*13.8VulnerableCloudFoundry Foundation
Show 52 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.9:*:*:*:*:*:*:*13.9VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.10:*:*:*:*:*:*:*13.10VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.11:*:*:*:*:*:*:*13.11VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24:*:*:*:*:*:*:*24VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.1:*:*:*:*:*:*:*24.1VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.2:*:*:*:*:*:*:*24.2VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.3:*:*:*:*:*:*:*24.3VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.4:*:*:*:*:*:*:*24.4VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.5:*:*:*:*:*:*:*24.5VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.6:*:*:*:*:*:*:*24.6VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30:*:*:*:*:*:*:*30VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30.1:*:*:*:*:*:*:*30.1VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30.2:*:*:*:*:*:*:*30.2VulnerableCloudFoundry Foundation
cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30.3:*:*:*:*:*:*:*30.3VulnerableCloudFoundry Foundation
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*up to 3.15.0VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.2.5.4:*:*:*:*:*:*:*2.2.5.4VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.1:*:*:*:*:*:*:*2.7.1VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.2:*:*:*:*:*:*:*2.7.2VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.3:*:*:*:*:*:*:*2.7.3VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4:*:*:*:*:*:*:*2.7.4VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.1:*:*:*:*:*:*:*2.7.4.1VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.2:*:*:*:*:*:*:*2.7.4.2VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.3:*:*:*:*:*:*:*2.7.4.3VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.4:*:*:*:*:*:*:*2.7.4.4VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.5:*:*:*:*:*:*:*2.7.4.5VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.6:*:*:*:*:*:*:*2.7.4.6VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.7:*:*:*:*:*:*:*2.7.4.7VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.8:*:*:*:*:*:*:*2.7.4.8VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.9:*:*:*:*:*:*:*2.7.4.9VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.11:*:*:*:*:*:*:*2.7.4.11VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.12:*:*:*:*:*:*:*2.7.4.12VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.13:*:*:*:*:*:*:*2.7.4.13VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.1:*:*:*:*:*:*:*3.6.1VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.2:*:*:*:*:*:*:*3.6.2VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.3:*:*:*:*:*:*:*3.6.3VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.4:*:*:*:*:*:*:*3.6.4VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.5:*:*:*:*:*:*:*3.6.5VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.6:*:*:*:*:*:*:*3.6.6VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.7:*:*:*:*:*:*:*3.6.7VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.8:*:*:*:*:*:*:*3.6.8VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.9:*:*:*:*:*:*:*3.6.9VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.1:*:*:*:*:*:*:*3.9.1VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.2:*:*:*:*:*:*:*3.9.2VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.3:*:*:*:*:*:*:*3.9.3VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.4:*:*:*:*:*:*:*3.9.4VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.5:*:*:*:*:*:*:*3.9.5VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.6:*:*:*:*:*:*:*3.9.6VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.7:*:*:*:*:*:*:*3.9.7VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.8:*:*:*:*:*:*:*3.9.8VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.9:*:*:*:*:*:*:*3.9.9VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.12:*:*:*:*:*:*:*3.9.12VulnerableSpring by Pivotal
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.13:*:*:*:*:*:*:*3.9.13VulnerableSpring by Pivotal
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.9:*:*:*:*:*:*:* Versions 13.9 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.10:*:*:*:*:*:*:* Versions 13.10 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.11:*:*:*:*:*:*:* Versions 13.11 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24:*:*:*:*:*:*:* Versions 24 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.1:*:*:*:*:*:*:* Versions 24.1 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.2:*:*:*:*:*:*:* Versions 24.2 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.3:*:*:*:*:*:*:* Versions 24.3 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.4:*:*:*:*:*:*:* Versions 24.4 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.5:*:*:*:*:*:*:* Versions 24.5 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.6:*:*:*:*:*:*:* Versions 24.6 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30.1:*:*:*:*:*:*:* Versions 30.1 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30.2:*:*:*:*:*:*:* Versions 30.2 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30.3:*:*:*:*:*:*:* Versions 30.3 Vulnerable ·CloudFoundry Foundation
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:* Versions up to 3.15.0 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.2.5.4:*:*:*:*:*:*:* Versions 2.2.5.4 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.2:*:*:*:*:*:*:* Versions 2.7.2 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.3:*:*:*:*:*:*:* Versions 2.7.3 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4:*:*:*:*:*:*:* Versions 2.7.4 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.1:*:*:*:*:*:*:* Versions 2.7.4.1 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.2:*:*:*:*:*:*:* Versions 2.7.4.2 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.3:*:*:*:*:*:*:* Versions 2.7.4.3 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.4:*:*:*:*:*:*:* Versions 2.7.4.4 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.5:*:*:*:*:*:*:* Versions 2.7.4.5 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.6:*:*:*:*:*:*:* Versions 2.7.4.6 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.7:*:*:*:*:*:*:* Versions 2.7.4.7 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.8:*:*:*:*:*:*:* Versions 2.7.4.8 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.9:*:*:*:*:*:*:* Versions 2.7.4.9 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.11:*:*:*:*:*:*:* Versions 2.7.4.11 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.12:*:*:*:*:*:*:* Versions 2.7.4.12 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.13:*:*:*:*:*:*:* Versions 2.7.4.13 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.1:*:*:*:*:*:*:* Versions 3.6.1 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.2:*:*:*:*:*:*:* Versions 3.6.2 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.3:*:*:*:*:*:*:* Versions 3.6.3 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.4:*:*:*:*:*:*:* Versions 3.6.4 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.5:*:*:*:*:*:*:* Versions 3.6.5 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.6:*:*:*:*:*:*:* Versions 3.6.6 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.7:*:*:*:*:*:*:* Versions 3.6.7 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.8:*:*:*:*:*:*:* Versions 3.6.8 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.9:*:*:*:*:*:*:* Versions 3.6.9 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.1:*:*:*:*:*:*:* Versions 3.9.1 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.2:*:*:*:*:*:*:* Versions 3.9.2 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.3:*:*:*:*:*:*:* Versions 3.9.3 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.4:*:*:*:*:*:*:* Versions 3.9.4 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.5:*:*:*:*:*:*:* Versions 3.9.5 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.6:*:*:*:*:*:*:* Versions 3.9.6 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.7:*:*:*:*:*:*:* Versions 3.9.7 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.8:*:*:*:*:*:*:* Versions 3.9.8 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.9:*:*:*:*:*:*:* Versions 3.9.9 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.12:*:*:*:*:*:*:* Versions 3.9.12 Vulnerable ·Spring by Pivotal
  • cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.13:*:*:*:*:*:*:* Versions 3.9.13 Vulnerable ·Spring by Pivotal

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-4972
  2. 2026-10-03 Alias added: GHSA-5w93-xgv6-rpgw

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences