Pivotal Software Cloud Foundry Uaa vulnerabilities
32 known vulnerabilities affecting pivotal_software/cloud_foundry_uaa.
Total CVEs
32
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL4HIGH18MEDIUM9LOW1
Vulnerabilities
Page 1 of 2
CVE-2019-11282MEDIUMCVSS 4.3fixed in 74.3.02019-10-23
CVE-2019-11282 [MEDIUM] CWE-200 CVE-2019-11282: Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM inject
Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of the UAA.
nvd
CVE-2019-11270HIGHCVSS 7.5fixed in 73.4.02019-08-05
CVE-2019-11270 [HIGH] CWE-269 CVE-2019-11270: Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possess
Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess.
nvd
CVE-2019-3794MEDIUMCVSS 5.4fixed in 73.4.02019-07-18
CVE-2019-3794 [MEDIUM] CWE-284 CVE-2019-3794: Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endp
Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites.
nvd
CVE-2018-15761HIGHCVSS 8.8fixed in 4.23.02018-11-19
CVE-2018-15761 [HIGH] CVE-2018-15761: Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a va
Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their privileges.
nvd
CVE-2018-11047HIGHCVSS 7.5≥ 4.5.0, < 4.5.7≥ 4.7.0, < 4.7.6+3 more2018-07-24
CVE-2018-11047 [HIGH] CWE-863 CVE-2018-11047: Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 a
Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly authorizes requests to admin endpoints by accepting a valid refresh token in lieu of an access token. Refresh tokens by design have a longer expiration time than access tokens, allowing the posse
nvd
CVE-2018-11041MEDIUMCVSS 6.1fixed in 4.7.5fixed in 4.10.1+1 more2018-06-25
CVE-2018-11041 [MEDIUM] CWE-601 CVE-2018-11041: Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-rel
Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open redirects. A remote attacker can craft a malicious link th
nvd
CVE-2018-1262HIGHCVSS 7.2v4.12.0v4.12.1+6 more2018-05-15
CVE-2018-1262 [HIGH] CVE-2018-1262: Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow pri
Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline validation. A zone administrator could configure their zone to issue tokens which impersonate another zone, granting up to admin privileges in the impersonated zone for clients performing offl
nvd
CVE-2018-1192HIGHCVSS 8.8≥ 4.5.0, < 4.5.5≥ 4.7.0, < 4.7.4+1 more2018-02-01
CVE-2018-1192 [HIGH] CWE-200 CVE-2018-1192: In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7;
In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versions prior to 53.3, the SessionID is logged in audit event l
nvd
CVE-2015-5172CRITICALCVSS 9.8fixed in 2.5.22017-10-24
CVE-2015-5172 [CRITICAL] CWE-640 CVE-2015-5172: Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elast
Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links.
nvd
CVE-2015-5171CRITICALCVSS 9.8fixed in 2.5.22017-10-24
CVE-2015-5171 [CRITICAL] CWE-613 CVE-2015-5171: The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2,
The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire existing sessions.
nvd
CVE-2015-5170HIGHCVSS 8.8fixed in 2.5.22017-10-24
CVE-2015-5170 [HIGH] CWE-352 CVE-2015-5170: Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elast
Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery (CSRF) attacks on PWS and log a user into an arbitrary account by leveraging lack of CSRF checks.
nvd
CVE-2015-5173HIGHCVSS 8.8fixed in 2.5.22017-10-24
CVE-2015-5173 [HIGH] CWE-200 CVE-2015-5173: Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elast
Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via vectors involving emails with password recovery links, aka "Cross Domain Referer Leakage."
nvd
CVE-2017-8032MEDIUMCVSS 6.6v2.2.5.4v2.7.1+45 more2017-07-10
CVE-2017-8032 [MEDIUM] CWE-269 CVE-2017-8032: In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x ve
In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions prior to v3.9.15, 3.20.x versions prior to v3.20.0, and other versions prior to v4.4.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.17, 24.x versions prior to v24.12. 30.x versions prior to 30.5,
cvelistv5nvd
CVE-2017-4992CRITICALCVSS 9.8≤ 4.2.0v2.2.5.4+42 more2017-06-13
CVE-2017-4992 [CRITICAL] CWE-269 CVE-2017-4992: An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior to v2.7.4.17, 3.6.x versions prior to v3.6.11, 3.9.x versions prior to v3.9.13, and other versions prior to v4.2.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.15, 24.x versions prior to v24.10, 30.x versions prior
nvd
CVE-2017-4991HIGHCVSS 7.2≤ 4.2.0v2.2.5.4+37 more2017-06-13
CVE-2017-4991 [HIGH] CWE-269 CVE-2017-4991: An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3.6.10, 3.9.x versions prior to v3.9.12, and other versions prior to v3.17.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.14, 24.x versions prior to v24.9, 30.x versions prior to 3
cvelistv5nvd
CVE-2017-4972HIGHCVSS 7.5≤ 3.15.0v2.2.5.4+37 more2017-06-13
CVE-2017-4972 [HIGH] CWE-89 CVE-2017-4972: An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prior to v3.15.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.12, 24.x versions prior to v24.7, and other versions prior t
cvelistv5nvd
CVE-2017-4973HIGHCVSS 8.8v2.2.5.4v2.7.1+34 more2017-06-13
CVE-2017-4973 [HIGH] CWE-269 CVE-2017-4973: An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prior to v3.15.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.12, 24.x versions prior to v24.7, and other versions prior
cvelistv5nvd
CVE-2017-4994HIGHCVSS 7.5≤ 4.2.0v2.2.5.4+44 more2017-06-13
CVE-2017-4994 [HIGH] CWE-20 CVE-2017-4994: An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v263; UAA release 2
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v263; UAA release 2.x versions prior to v2.7.4.18, 3.6.x versions prior to v3.6.12, 3.9.x versions prior to v3.9.14, and other versions prior to v4.3.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.16, 24.x versions prior to v24.11, 30.x versions prior to 30
nvd
CVE-2017-4963HIGHCVSS 8.1≥ 2.0.0, ≤ 2.7.4.12≥ 3.0.0, ≤ 3.11.02017-06-13
CVE-2017-4963 [HIGH] CWE-384 CVE-2017-4963: An issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier versions,
An issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier versions, UAA stand-alone release v2.0.0 - v2.7.4.12 & v3.0.0 - v3.11.0, and UAA bosh release v26 & earlier versions. UAA is vulnerable to session fixation when configured to authenticate against external SAML or OpenID Connect based identity providers.
nvd
CVE-2017-4974MEDIUMCVSS 6.5≤ 4.2.0v2.2.5.4+38 more2017-06-13
CVE-2017-4974 [MEDIUM] CWE-89 CVE-2017-4974: An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x versions prior to v3.6.9, 3.9.x versions prior to v3.9.11, and other versions prior to v3.16.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.13, 24.x versions prior to v24.8, and other versions prior
cvelistv5nvd
1 / 2Next →