Vulnerabilities

TI-2025-16156 CVE-2025-22246 · GHSA-f42p-pxc9-254g

CVE-2025-22246 – UAA Private Key Exposure

LOW 32

Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00204 Published 2025-05-13 Fixed CWE-532

TI-2019-08437 CVE-2019-11279 · GHSA-272q-hvx6-q97c

Privilege Escalation via Scope Manipulation in UAA

MEDIUM 41

CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0133 Published 2019-09-26 Fixed in 74.1.0 CWE-77

TI-2019-02813 CVE-2019-3801 · GHSA-4w8g-vwqf-w48w

Java Projects using HTTP to fetch dependencies

MEDIUM 43

Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00588 Published 2019-04-25 Fixed in 2.1.3, 1.9.10 +4 CWE-494

TI-2019-02802 CVE-2019-3788 · GHSA-qf8p-gpw6-r52g

UAA redirect-uri allows wildcard in the subdomain

LOW 39

Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri.

CVSS 3.0HIGH 8.7 Network No auth No interaction EPSS 0.00832 Published 2019-04-25 Fixed in v71.0, 2.5.1 CWE-601

TI-2019-02789 CVE-2019-3775 · GHSA-hwg9-rc2h-c2p3

UAA allows users to modify their own email address

LOW 33

Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address.

CVSS 3.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00876 Published 2019-03-07 Fixed in v70.0 CWE-290