Information disclosure in Cloud Foundry UAA server
Priority LOW 35CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider( IdP) of type “oauth 1.0” was sent to UAA server.
Why it matters now
EPSS 0.00986 62nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cloud Foundry UAA server | Cloud Foundry UAA server prior to version 75.3.0 | — | No fix listed | CNA |
- Cloud Foundry UAA server Vendor— Affected Cloud Foundry UAA server prior to version 75.3.0 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:* | before 16.18.0 | Vulnerable | CloudFoundry Foundation |
| cpe:2.3:a:cloudfoundry:user_account_and_authentication:*:*:*:*:*:*:*:* | before 75.3.0 | Vulnerable | CloudFoundry Foundation |
- cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:* Versions before 16.18.0 Vulnerable ·CloudFoundry Foundation
- cpe:2.3:a:cloudfoundry:user_account_and_authentication:*:*:*:*:*:*:*:* Versions before 75.3.0 Vulnerable ·CloudFoundry Foundation
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-22001
- 2026-10-03 Alias added: GHSA-8f73-86rh-w9fj
References
More CloudFoundry Foundation Cf-deployment vulnerabilities
- TI-2022-13629 Improper certificate validation in Cloud Foundry Diego and CF Deployment CVSS 3.1CRITICAL 9.1
- TI-2019-02813 Java Projects using HTTP to fetch dependencies CVSS 3.1CRITICAL 9.8
- TI-2019-08441 Password leak in smbdriver logs CVSS 3.1HIGH 8.8
- TI-2020-04463 Cloud Controller may allow developers to claim sensitive routes CVSS 3.1HIGH 8.8
- TI-2019-08446 A forged route service request using an invalid nonce can cause the gorouter to panic and crash CVSS 3.1HIGH 8.6
- TI-2018-01109 Insufficient session expiration in Dell EMC Cloud Controller CVSS 3.1HIGH 8.8
Sources
- CVE-2021-22001 · CVE Program
- CVE-2021-22001 · NVD
- FIRST EPSS
- GHSA-8f73-86rh-w9fj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences