CVE-2017-4974
published 2017-06-13CVE-2017-4974: An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x versions prior to…
PriorityP338medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.97%
57.7th percentile
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x versions prior to v3.6.9, 3.9.x versions prior to v3.9.11, and other versions prior to v3.16.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.13, 24.x versions prior to v24.8, and other versions prior to v30.1. An authorized user can use a blind SQL injection attack to query the contents of the UAA database, aka "Blind SQL Injection with privileged UAA endpoints."
Affected
65 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cloudfoundry | cf-release | <= v257 | — |
| cloudfoundry | cloud_foundry_uaa_bosh | <= 30 | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
| cloudfoundry | cloud_foundry_uaa_bosh | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Blind SQL Injection with privileged Cloud Foundry UAA endpoints
ghsa·2022-05-13
CVE-2017-4974 [MEDIUM] CWE-89 Blind SQL Injection with privileged Cloud Foundry UAA endpoints
Blind SQL Injection with privileged Cloud Foundry UAA endpoints
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x versions prior to v3.6.9, 3.9.x versions prior to v3.9.11, and other versions prior to v3.16.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.13, 24.x versions prior to v24.8, and other versions prior to v30.1. An authorized user can use a blind SQL injection attack to query the contents of the UAA database, aka "Blind SQL Injection with privileged UAA endpoints."
OSV
Blind SQL Injection with privileged Cloud Foundry UAA endpoints
osv·2022-05-13
CVE-2017-4974 [MEDIUM] Blind SQL Injection with privileged Cloud Foundry UAA endpoints
Blind SQL Injection with privileged Cloud Foundry UAA endpoints
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x versions prior to v3.6.9, 3.9.x versions prior to v3.9.11, and other versions prior to v3.16.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.13, 24.x versions prior to v24.8, and other versions prior to v30.1. An authorized user can use a blind SQL injection attack to query the contents of the UAA database, aka "Blind SQL Injection with privileged UAA endpoints."
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2017-06-13
Published