Improper privilege management in Cloud Foundry
Priority MEDIUM 44CWE-269Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-269.
Summary
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior to v2.7.4.17, 3.6.x versions prior to v3.6.11, 3.9.x versions prior to v3.9.13, and other versions prior to v4.2.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.15, 24.x versions prior to v24.10, 30.x versions prior to 30.3, and other versions prior to v37. There is privilege escalation (arbitrary password reset) with user invitations.
Why it matters now
EPSS 0.01167 67th percentileScored 2026-11-07
Fix Fixed org.cloudfoundry.identity:cloudfoundry-identity-server (Maven): 2.7.4.17, 3.6.11, 3.9.13 +1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cloud Foundry | Cloud Foundry | — | No fix listed | CNA |
| — | org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) | 2.0.0 to before 2.7.4.17 | 2.7.4.17 | Patch available | GHSA-jcmh-x32v-7mgf |
| — | org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) | 3.0.0 to before 3.6.11 | 3.6.11 | Patch available | GHSA-jcmh-x32v-7mgf |
| — | org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) | 3.7.0 to before 3.9.13 | 3.9.13 | Patch available | GHSA-jcmh-x32v-7mgf |
| — | org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) | 3.10.0 to before 4.2.0 | 4.2.0 | Patch available | GHSA-jcmh-x32v-7mgf |
- Cloud Foundry Vendor— Affected Cloud Foundry Fixed in — No fix listed CNA
- org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Vendor— Affected 2.0.0 to before 2.7.4.17 Fixed in 2.7.4.17 Patch available GHSA-jcmh-x32v-7mgf
- org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Vendor— Affected 3.0.0 to before 3.6.11 Fixed in 3.6.11 Patch available GHSA-jcmh-x32v-7mgf
- org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Vendor— Affected 3.7.0 to before 3.9.13 Fixed in 3.9.13 Patch available GHSA-jcmh-x32v-7mgf
- org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Vendor— Affected 3.10.0 to before 4.2.0 Fixed in 4.2.0 Patch available GHSA-jcmh-x32v-7mgf
CPE configurations NVD · 73
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cloudfoundry:cf-release:*:*:*:*:*:*:*:* | up to 260 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:*:*:*:*:*:*:*:* | up to 27 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.1:*:*:*:*:*:*:* | 13.1 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.2:*:*:*:*:*:*:* | 13.2 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.3:*:*:*:*:*:*:* | 13.3 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.4:*:*:*:*:*:*:* | 13.4 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.5:*:*:*:*:*:*:* | 13.5 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.6:*:*:*:*:*:*:* | 13.6 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.7:*:*:*:*:*:*:* | 13.7 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.8:*:*:*:*:*:*:* | 13.8 | Vulnerable | CloudFoundry Foundation |
- cpe:2.3:a:cloudfoundry:cf-release:*:*:*:*:*:*:*:* Versions up to 260 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:*:*:*:*:*:*:*:* Versions up to 27 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.1:*:*:*:*:*:*:* Versions 13.1 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.2:*:*:*:*:*:*:* Versions 13.2 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.3:*:*:*:*:*:*:* Versions 13.3 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.4:*:*:*:*:*:*:* Versions 13.4 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.5:*:*:*:*:*:*:* Versions 13.5 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.6:*:*:*:*:*:*:* Versions 13.6 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.7:*:*:*:*:*:*:* Versions 13.7 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.8:*:*:*:*:*:*:* Versions 13.8 Vulnerable ·CloudFoundry Foundation
Show 63 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.9:*:*:*:*:*:*:* | 13.9 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.10:*:*:*:*:*:*:* | 13.10 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.11:*:*:*:*:*:*:* | 13.11 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.12:*:*:*:*:*:*:* | 13.12 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.13:*:*:*:*:*:*:* | 13.13 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.14:*:*:*:*:*:*:* | 13.14 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24:*:*:*:*:*:*:* | 24 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.1:*:*:*:*:*:*:* | 24.1 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.2:*:*:*:*:*:*:* | 24.2 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.3:*:*:*:*:*:*:* | 24.3 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.4:*:*:*:*:*:*:* | 24.4 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.5:*:*:*:*:*:*:* | 24.5 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.6:*:*:*:*:*:*:* | 24.6 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.7:*:*:*:*:*:*:* | 24.7 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.8:*:*:*:*:*:*:* | 24.8 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.9:*:*:*:*:*:*:* | 24.9 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30:*:*:*:*:*:*:* | 30 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30.1:*:*:*:*:*:*:* | 30.1 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30.2:*:*:*:*:*:*:* | 30.2 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:* | up to 4.2.0 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.2.5.4:*:*:*:*:*:*:* | 2.2.5.4 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.1:*:*:*:*:*:*:* | 2.7.1 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.2:*:*:*:*:*:*:* | 2.7.2 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.3:*:*:*:*:*:*:* | 2.7.3 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4:*:*:*:*:*:*:* | 2.7.4 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.1:*:*:*:*:*:*:* | 2.7.4.1 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.2:*:*:*:*:*:*:* | 2.7.4.2 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.3:*:*:*:*:*:*:* | 2.7.4.3 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.4:*:*:*:*:*:*:* | 2.7.4.4 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.5:*:*:*:*:*:*:* | 2.7.4.5 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.6:*:*:*:*:*:*:* | 2.7.4.6 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.7:*:*:*:*:*:*:* | 2.7.4.7 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.8:*:*:*:*:*:*:* | 2.7.4.8 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.9:*:*:*:*:*:*:* | 2.7.4.9 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.11:*:*:*:*:*:*:* | 2.7.4.11 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.12:*:*:*:*:*:*:* | 2.7.4.12 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.13:*:*:*:*:*:*:* | 2.7.4.13 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.14:*:*:*:*:*:*:* | 2.7.4.14 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.15:*:*:*:*:*:*:* | 2.7.4.15 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.16:*:*:*:*:*:*:* | 2.7.4.16 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.1:*:*:*:*:*:*:* | 3.6.1 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.2:*:*:*:*:*:*:* | 3.6.2 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.3:*:*:*:*:*:*:* | 3.6.3 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.4:*:*:*:*:*:*:* | 3.6.4 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.5:*:*:*:*:*:*:* | 3.6.5 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.6:*:*:*:*:*:*:* | 3.6.6 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.7:*:*:*:*:*:*:* | 3.6.7 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.8:*:*:*:*:*:*:* | 3.6.8 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.9:*:*:*:*:*:*:* | 3.6.9 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.10:*:*:*:*:*:*:* | 3.6.10 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.1:*:*:*:*:*:*:* | 3.9.1 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.2:*:*:*:*:*:*:* | 3.9.2 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.3:*:*:*:*:*:*:* | 3.9.3 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.4:*:*:*:*:*:*:* | 3.9.4 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.5:*:*:*:*:*:*:* | 3.9.5 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.6:*:*:*:*:*:*:* | 3.9.6 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.7:*:*:*:*:*:*:* | 3.9.7 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.8:*:*:*:*:*:*:* | 3.9.8 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.9:*:*:*:*:*:*:* | 3.9.9 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.10:*:*:*:*:*:*:* | 3.9.10 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.11:*:*:*:*:*:*:* | 3.9.11 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.12:*:*:*:*:*:*:* | 3.9.12 | Vulnerable | Spring by Pivotal |
| cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.13:*:*:*:*:*:*:* | 3.9.13 | Vulnerable | Spring by Pivotal |
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.9:*:*:*:*:*:*:* Versions 13.9 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.10:*:*:*:*:*:*:* Versions 13.10 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.11:*:*:*:*:*:*:* Versions 13.11 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.12:*:*:*:*:*:*:* Versions 13.12 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.13:*:*:*:*:*:*:* Versions 13.13 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:13.14:*:*:*:*:*:*:* Versions 13.14 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24:*:*:*:*:*:*:* Versions 24 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.1:*:*:*:*:*:*:* Versions 24.1 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.2:*:*:*:*:*:*:* Versions 24.2 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.3:*:*:*:*:*:*:* Versions 24.3 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.4:*:*:*:*:*:*:* Versions 24.4 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.5:*:*:*:*:*:*:* Versions 24.5 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.6:*:*:*:*:*:*:* Versions 24.6 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.7:*:*:*:*:*:*:* Versions 24.7 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.8:*:*:*:*:*:*:* Versions 24.8 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:24.9:*:*:*:*:*:*:* Versions 24.9 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30.1:*:*:*:*:*:*:* Versions 30.1 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:cloud_foundry_uaa_bosh:30.2:*:*:*:*:*:*:* Versions 30.2 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:* Versions up to 4.2.0 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.2.5.4:*:*:*:*:*:*:* Versions 2.2.5.4 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.2:*:*:*:*:*:*:* Versions 2.7.2 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.3:*:*:*:*:*:*:* Versions 2.7.3 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4:*:*:*:*:*:*:* Versions 2.7.4 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.1:*:*:*:*:*:*:* Versions 2.7.4.1 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.2:*:*:*:*:*:*:* Versions 2.7.4.2 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.3:*:*:*:*:*:*:* Versions 2.7.4.3 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.4:*:*:*:*:*:*:* Versions 2.7.4.4 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.5:*:*:*:*:*:*:* Versions 2.7.4.5 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.6:*:*:*:*:*:*:* Versions 2.7.4.6 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.7:*:*:*:*:*:*:* Versions 2.7.4.7 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.8:*:*:*:*:*:*:* Versions 2.7.4.8 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.9:*:*:*:*:*:*:* Versions 2.7.4.9 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.11:*:*:*:*:*:*:* Versions 2.7.4.11 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.12:*:*:*:*:*:*:* Versions 2.7.4.12 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.13:*:*:*:*:*:*:* Versions 2.7.4.13 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.14:*:*:*:*:*:*:* Versions 2.7.4.14 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.15:*:*:*:*:*:*:* Versions 2.7.4.15 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:2.7.4.16:*:*:*:*:*:*:* Versions 2.7.4.16 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.1:*:*:*:*:*:*:* Versions 3.6.1 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.2:*:*:*:*:*:*:* Versions 3.6.2 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.3:*:*:*:*:*:*:* Versions 3.6.3 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.4:*:*:*:*:*:*:* Versions 3.6.4 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.5:*:*:*:*:*:*:* Versions 3.6.5 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.6:*:*:*:*:*:*:* Versions 3.6.6 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.7:*:*:*:*:*:*:* Versions 3.6.7 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.8:*:*:*:*:*:*:* Versions 3.6.8 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.9:*:*:*:*:*:*:* Versions 3.6.9 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.6.10:*:*:*:*:*:*:* Versions 3.6.10 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.1:*:*:*:*:*:*:* Versions 3.9.1 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.2:*:*:*:*:*:*:* Versions 3.9.2 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.3:*:*:*:*:*:*:* Versions 3.9.3 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.4:*:*:*:*:*:*:* Versions 3.9.4 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.5:*:*:*:*:*:*:* Versions 3.9.5 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.6:*:*:*:*:*:*:* Versions 3.9.6 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.7:*:*:*:*:*:*:* Versions 3.9.7 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.8:*:*:*:*:*:*:* Versions 3.9.8 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.9:*:*:*:*:*:*:* Versions 3.9.9 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.10:*:*:*:*:*:*:* Versions 3.9.10 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.11:*:*:*:*:*:*:* Versions 3.9.11 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.12:*:*:*:*:*:*:* Versions 3.9.12 Vulnerable ·Spring by Pivotal
- cpe:2.3:a:pivotal_software:cloud_foundry_uaa:3.9.13:*:*:*:*:*:*:* Versions 3.9.13 Vulnerable ·Spring by Pivotal
Remediation
- Fix · GHSA-jcmh-x32v-7mgf org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Fixed in 2.7.4.17 Advisory →
- Fix · GHSA-jcmh-x32v-7mgf org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Fixed in 3.6.11 Advisory →
- Fix · GHSA-jcmh-x32v-7mgf org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Fixed in 3.9.13 Advisory →
- Fix · GHSA-jcmh-x32v-7mgf org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) Fixed in 4.2.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-4992
- 2026-10-03 Alias added: GHSA-jcmh-x32v-7mgf
References
Other 6
- https://github.com/cloudfoundry/uaa/commit/1c9c6dd88266cfa7d333e5d8be1031fa31c5c939
- https://github.com/cloudfoundry/uaa/commit/3ce42a4c75828cb58287c3c7495dde3f5261f12c
- https://github.com/cloudfoundry/uaa/commit/4f942064d85454a4bcc4da04cd482d114816c14a
- https://github.com/cloudfoundry/uaa/commit/96a294013c0c9a13ef32afc49d2b759f5107dc49
- https://github.com/cloudfoundry/uaa
- https://www.cloudfoundry.org/cve-2017-4992
Sources
- CVE-2017-4992 · CVE Program
- CVE-2017-4992 · NVD
- FIRST EPSS
- GHSA-jcmh-x32v-7mgf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences