Cloud Foundry UAA Release vulnerabilities
6 vulnerabilities
Known vulnerabilities in Cloud Foundry UAA Release, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-11082cloud foundryuaa+3
EPSS score1.10%
Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user.CVE-2018-15754cloud foundryuaa release+1EPSS score1.78%
Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts across identity providers with the same username, a remote authenticated user with access to one of these accounts may be able to obtain a token for an account of the same username in the other identity provider.CVE-2018-15761cloud foundryuaa+4EPSS score1.71%
Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their privileges.CVE-2019-11293cloud foundryuaa release+2EPSS score1.32%
Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters.CVE-2019-11282cloud foundrycf deployment+3EPSS score1.14%
Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of the UAA.CVE-2019-11290cloud foundryuaa release+2EPSS score1.28%
Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.