Vulnerabilities

TI-2019-08426 CVE-2019-11268 · GHSA-j3cm-76qq-2qmp

UAA SQL Identity Zone Vulnerability

LOW 22

Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00987 Published 2019-07-11 Fixed in v73.3.0 CWE-200

TI-2019-02801 CVE-2019-3787 · GHSA-7rf4-2hjj-cg48

UAA defaults email address to an insecure domain

MEDIUM 40

Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01102 Published 2019-06-19 Fixed in v73.0.0 CWE-840

TI-2018-11235 CVE-2018-15754 · GHSA-6c8m-9r93-f9rp

UAA can issue tokens across identity providers if users with matching usernames exist

MEDIUM 42

Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01782 Published 2018-12-13 Fixed in 66.0 CWE-863

TI-2018-07829 CVE-2018-11041 · GHSA-xh4m-99qp-w483

Open redirect in Cloud Foundry UAA

LOW 29

Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form pa…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00837 Published 2018-06-25 Fixed in 4.7.5, 4.10.1 +2 CWE-601

TI-2018-01167 CVE-2018-1262 · GHSA-8v97-gv3g-32rf

Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which…

LOW 34

Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline validation.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.01293 Published 2018-05-15 Fixed in 4.12.2, 4.13.4

TI-2018-01107 CVE-2018-1192 · GHSA-xg5v-696h-c3vr

Information disclosure in Cloud Foundry Foundation cf-release versions prior to v285…

MEDIUM 40

In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01015 Published 2018-02-01 Fixed in 4.5.5, 4.7.4 +1 CWE-200

TI-2017-03088 CVE-2017-4963 · GHSA-v3fx-g84p-g838

Session fixation in Cloud Foundry Foundation

LOW 37

An issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier versions, UAA stand-alone release v2.0.0 - v2.7.4.12 & v3.0.0 - v3.11.0, and UAA bosh release v26 & earlier versions.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.009 Published 2017-06-13 No fix listed CWE-384

TI-2016-04335 CVE-2016-5016 · GHSA-rc2r-w8jv-vggp

Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server)…

LOW 28

Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elasti…

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.01032 Published 2017-04-24 Fixed in 3.3.0.3, 3.4.2 CWE-295

Vulnerabilities

Filters