Improper privilege management in Cloud Foundry UAA
Priority LOW 33CWE-269Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-269.
Summary
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3.6.10, 3.9.x versions prior to v3.9.12, and other versions prior to v3.17.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.14, 24.x versions prior to v24.9, 30.x versions prior to 30.2, and other versions prior to v36. Privileged users in one zone are allowed to perform a password reset for users in a different zone.
Why it matters now
EPSS 0.00936 61st percentileScored 2026-11-07
Fix Fixed org.cloudfoundry.identity:cloudfoundry-identity-server (Maven): 2.7.4.16, 3.6.10, 3.9.12 +1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cloud Foundry UAA | Cloud Foundry UAA | — | No fix listed | CNA |
| — | org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) | 2.0.0 to before 2.7.4.16 | 2.7.4.16 | Patch available | GHSA-cgrg-x34r-78f3 |
| — | org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) | 3.0.0 to before 3.6.10 | 3.6.10 | Patch available | GHSA-cgrg-x34r-78f3 |
| — | org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) | 3.7.0 to before 3.9.12 | 3.9.12 | Patch available | GHSA-cgrg-x34r-78f3 |
| — | org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) | 3.10.0 to before 3.17.0 | 3.17.0 | Patch available | GHSA-cgrg-x34r-78f3 |
- Cloud Foundry UAA Vendor— Affected Cloud Foundry UAA Fixed in — No fix listed CNA
- org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Vendor— Affected 2.0.0 to before 2.7.4.16 Fixed in 2.7.4.16 Patch available GHSA-cgrg-x34r-78f3
- org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Vendor— Affected 3.0.0 to before 3.6.10 Fixed in 3.6.10 Patch available GHSA-cgrg-x34r-78f3
- org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Vendor— Affected 3.7.0 to before 3.9.12 Fixed in 3.9.12 Patch available GHSA-cgrg-x34r-78f3
- org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Vendor— Affected 3.10.0 to before 3.17.0 Fixed in 3.17.0 Patch available GHSA-cgrg-x34r-78f3
CPE configurations NVD · 66
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cloudfoundry:cf-release:*:*:*:*:*:*:*:* | up to 259 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:*:*:*:*:*:*:*:* | up to 35 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.1:*:*:*:*:*:*:* | 13.1 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.2:*:*:*:*:*:*:* | 13.2 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.3:*:*:*:*:*:*:* | 13.3 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.4:*:*:*:*:*:*:* | 13.4 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.5:*:*:*:*:*:*:* | 13.5 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.6:*:*:*:*:*:*:* | 13.6 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.7:*:*:*:*:*:*:* | 13.7 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.8:*:*:*:*:*:*:* | 13.8 | Vulnerable | CloudFoundry Foundation |
- cpe:2.3:a:cloudfoundry:cf-release:*:*:*:*:*:*:*:* Versions up to 259 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:*:*:*:*:*:*:*:* Versions up to 35 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.1:*:*:*:*:*:*:* Versions 13.1 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.2:*:*:*:*:*:*:* Versions 13.2 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.3:*:*:*:*:*:*:* Versions 13.3 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.4:*:*:*:*:*:*:* Versions 13.4 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.5:*:*:*:*:*:*:* Versions 13.5 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.6:*:*:*:*:*:*:* Versions 13.6 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.7:*:*:*:*:*:*:* Versions 13.7 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.8:*:*:*:*:*:*:* Versions 13.8 Vulnerable ·CloudFoundry Foundation
Show 56 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.9:*:*:*:*:*:*:* | 13.9 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.10:*:*:*:*:*:*:* | 13.10 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.11:*:*:*:*:*:*:* | 13.11 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.12:*:*:*:*:*:*:* | 13.12 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.13:*:*:*:*:*:*:* | 13.13 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24:*:*:*:*:*:*:* | 24 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.1:*:*:*:*:*:*:* | 24.1 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.2:*:*:*:*:*:*:* | 24.2 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.3:*:*:*:*:*:*:* | 24.3 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.4:*:*:*:*:*:*:* | 24.4 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.5:*:*:*:*:*:*:* | 24.5 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.6:*:*:*:*:*:*:* | 24.6 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.7:*:*:*:*:*:*:* | 24.7 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.8:*:*:*:*:*:*:* | 24.8 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.9:*:*:*:*:*:*:* | 24.9 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.10:*:*:*:*:*:*:* | 24.10 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30:*:*:*:*:*:*:* | 30 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30.1:*:*:*:*:*:*:* | 30.1 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:* | up to 4.2.0 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.2.5.4:*:*:*:*:*:*:* | 2.2.5.4 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.1:*:*:*:*:*:*:* | 2.7.1 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.2:*:*:*:*:*:*:* | 2.7.2 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.3:*:*:*:*:*:*:* | 2.7.3 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4:*:*:*:*:*:*:* | 2.7.4 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.1:*:*:*:*:*:*:* | 2.7.4.1 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.2:*:*:*:*:*:*:* | 2.7.4.2 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.3:*:*:*:*:*:*:* | 2.7.4.3 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.4:*:*:*:*:*:*:* | 2.7.4.4 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.5:*:*:*:*:*:*:* | 2.7.4.5 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.6:*:*:*:*:*:*:* | 2.7.4.6 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.7:*:*:*:*:*:*:* | 2.7.4.7 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.8:*:*:*:*:*:*:* | 2.7.4.8 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.9:*:*:*:*:*:*:* | 2.7.4.9 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.11:*:*:*:*:*:*:* | 2.7.4.11 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.12:*:*:*:*:*:*:* | 2.7.4.12 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.13:*:*:*:*:*:*:* | 2.7.4.13 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.14:*:*:*:*:*:*:* | 2.7.4.14 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.15:*:*:*:*:*:*:* | 2.7.4.15 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.1:*:*:*:*:*:*:* | 3.6.1 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.2:*:*:*:*:*:*:* | 3.6.2 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.3:*:*:*:*:*:*:* | 3.6.3 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.4:*:*:*:*:*:*:* | 3.6.4 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.5:*:*:*:*:*:*:* | 3.6.5 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.6:*:*:*:*:*:*:* | 3.6.6 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.7:*:*:*:*:*:*:* | 3.6.7 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.8:*:*:*:*:*:*:* | 3.6.8 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.9:*:*:*:*:*:*:* | 3.6.9 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.1:*:*:*:*:*:*:* | 3.9.1 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.2:*:*:*:*:*:*:* | 3.9.2 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.3:*:*:*:*:*:*:* | 3.9.3 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.4:*:*:*:*:*:*:* | 3.9.4 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.5:*:*:*:*:*:*:* | 3.9.5 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.6:*:*:*:*:*:*:* | 3.9.6 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.7:*:*:*:*:*:*:* | 3.9.7 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.8:*:*:*:*:*:*:* | 3.9.8 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.9:*:*:*:*:*:*:* | 3.9.9 | Vulnerable | Spring by Pivotal |
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.9:*:*:*:*:*:*:* Versions 13.9 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.10:*:*:*:*:*:*:* Versions 13.10 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.11:*:*:*:*:*:*:* Versions 13.11 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.12:*:*:*:*:*:*:* Versions 13.12 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.13:*:*:*:*:*:*:* Versions 13.13 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24:*:*:*:*:*:*:* Versions 24 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.1:*:*:*:*:*:*:* Versions 24.1 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.2:*:*:*:*:*:*:* Versions 24.2 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.3:*:*:*:*:*:*:* Versions 24.3 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.4:*:*:*:*:*:*:* Versions 24.4 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.5:*:*:*:*:*:*:* Versions 24.5 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.6:*:*:*:*:*:*:* Versions 24.6 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.7:*:*:*:*:*:*:* Versions 24.7 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.8:*:*:*:*:*:*:* Versions 24.8 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.9:*:*:*:*:*:*:* Versions 24.9 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.10:*:*:*:*:*:*:* Versions 24.10 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30.1:*:*:*:*:*:*:* Versions 30.1 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:* Versions up to 4.2.0 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.2.5.4:*:*:*:*:*:*:* Versions 2.2.5.4 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.2:*:*:*:*:*:*:* Versions 2.7.2 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.3:*:*:*:*:*:*:* Versions 2.7.3 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4:*:*:*:*:*:*:* Versions 2.7.4 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.1:*:*:*:*:*:*:* Versions 2.7.4.1 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.2:*:*:*:*:*:*:* Versions 2.7.4.2 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.3:*:*:*:*:*:*:* Versions 2.7.4.3 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.4:*:*:*:*:*:*:* Versions 2.7.4.4 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.5:*:*:*:*:*:*:* Versions 2.7.4.5 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.6:*:*:*:*:*:*:* Versions 2.7.4.6 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.7:*:*:*:*:*:*:* Versions 2.7.4.7 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.8:*:*:*:*:*:*:* Versions 2.7.4.8 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.9:*:*:*:*:*:*:* Versions 2.7.4.9 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.11:*:*:*:*:*:*:* Versions 2.7.4.11 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.12:*:*:*:*:*:*:* Versions 2.7.4.12 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.13:*:*:*:*:*:*:* Versions 2.7.4.13 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.14:*:*:*:*:*:*:* Versions 2.7.4.14 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.15:*:*:*:*:*:*:* Versions 2.7.4.15 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.1:*:*:*:*:*:*:* Versions 3.6.1 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.2:*:*:*:*:*:*:* Versions 3.6.2 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.3:*:*:*:*:*:*:* Versions 3.6.3 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.4:*:*:*:*:*:*:* Versions 3.6.4 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.5:*:*:*:*:*:*:* Versions 3.6.5 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.6:*:*:*:*:*:*:* Versions 3.6.6 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.7:*:*:*:*:*:*:* Versions 3.6.7 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.8:*:*:*:*:*:*:* Versions 3.6.8 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.9:*:*:*:*:*:*:* Versions 3.6.9 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.1:*:*:*:*:*:*:* Versions 3.9.1 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.2:*:*:*:*:*:*:* Versions 3.9.2 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.3:*:*:*:*:*:*:* Versions 3.9.3 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.4:*:*:*:*:*:*:* Versions 3.9.4 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.5:*:*:*:*:*:*:* Versions 3.9.5 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.6:*:*:*:*:*:*:* Versions 3.9.6 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.7:*:*:*:*:*:*:* Versions 3.9.7 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.8:*:*:*:*:*:*:* Versions 3.9.8 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.9:*:*:*:*:*:*:* Versions 3.9.9 Vulnerable ·Spring by Pivotal
Remediation
- Fix · GHSA-cgrg-x34r-78f3 org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Fixed in 2.7.4.16 Advisory →
- Fix · GHSA-cgrg-x34r-78f3 org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Fixed in 3.6.10 Advisory →
- Fix · GHSA-cgrg-x34r-78f3 org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Fixed in 3.9.12 Advisory →
- Fix · GHSA-cgrg-x34r-78f3 org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Fixed in 3.17.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-4991
- 2026-10-03 Alias added: GHSA-cgrg-x34r-78f3
References
Other 6
- https://github.com/cloudfoundry/uaa/commit/2ca35f1723e039aa7d2318134b05d02e40072a18
- https://github.com/cloudfoundry/uaa/commit/ba23bcf109704ab2eae519b705d7b2a75e023553
- https://github.com/cloudfoundry/uaa/commit/bbf6751bc0d87c4a3aaf21b54e26ce328ab998b3
- https://github.com/cloudfoundry/uaa/commit/eb3f86054489039e11eabd54a8ec9a46c22abfc8
- https://github.com/cloudfoundry/uaa
- https://www.cloudfoundry.org/cve-2017-4991
Sources
- CVE-2017-4991 · CVE Program
- CVE-2017-4991 · NVD
- FIRST EPSS
- GHSA-cgrg-x34r-78f3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences