CVE-2018-11047: Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly…

PriorityP340high7.5CVSS 3.0

AVNACLPRNUINSUCNIHAN

EPSS

1.07%

60.6th percentile

Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly authorizes requests to admin endpoints by accepting a valid refresh token in lieu of an access token. Refresh tokens by design have a longer expiration time than access tokens, allowing the possessor of a refresh token to authenticate longer than expected. This affects the administrative endpoints of the UAA. i.e. /Users, /Groups, etc. However, if the user has been deleted or had groups removed, or the client was deleted, the refresh token will no longer be valid.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
cloud_foundry	cloud_foundry_uaa	>= 4.10 < 4.10.2	4.10.2
cloud_foundry	cloud_foundry_uaa	>= 4.12 < 4.12.4	4.12.4
cloud_foundry	cloud_foundry_uaa	>= 4.19 < 4.19.2	4.19.2
cloud_foundry	cloud_foundry_uaa	>= 4.5 < 4.5.7	4.5.7
cloud_foundry	cloud_foundry_uaa	>= 4.7 < 4.7.6	4.7.6
pivotal_software	cloud_foundry_uaa	>= 4.10.0 < 4.10.2	4.10.2
pivotal_software	cloud_foundry_uaa	>= 4.12.0 < 4.12.4	4.12.4
pivotal_software	cloud_foundry_uaa	>= 4.19.0 < 4.19.2	4.19.2
pivotal_software	cloud_foundry_uaa	>= 4.5.0 < 4.5.7	4.5.7
pivotal_software	cloud_foundry_uaa	>= 4.7.0 < 4.7.6	4.7.6

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.