RSS   Vulnerabilities for 'Cloud foundry uaa-release'   RSS

2018-06-25
 
CVE-2018-11041

CWE-601
 

 
Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open redirects. A remote attacker can craft a malicious link that, when clicked, will redirect users to arbitrary websites after a successful login attempt.

 
2018-05-15
 
CVE-2018-1262

CWE-264
 

 
Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline validation. A zone administrator could configure their zone to issue tokens which impersonate another zone, granting up to admin privileges in the impersonated zone for clients performing offline token validation.

 
2018-02-01
 
CVE-2018-1192

CWE-200
 

 
In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versions prior to 53.3, the SessionID is logged in audit event logs. An attacker can use the SessionID to impersonate a logged-in user.

 
2017-04-24
 
CVE-2016-5016

CWE-295
 

 
Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.

 

 >>> Vendor: Pivotal software 48 Products
Rabbitmq management
Rabbitmq
Spring framework
Redis
Cloud foundry
Cloud foundry elastic runtime
Cloud foundry ops manager
Cloud foundry uaa
Cloud foundry uaa bosh
Operations manager
Spring data jpa
Cloud foundry cf mysql
Greenplum
Gemfire for pivotal cloud foundry
Spring security
Cloud foundry elastic runtime cf release
Cloud foundry uaa release
Login-server
Cloud foundry cf release
Cloud foundry garden linux
Cloud foundry cf
Spring social
Single sign-on for pivotal cloud foundry
Grootfs
Spring advanced message queuing protocol
Cf-deployment
Spring-ldap
Cf-release
Uaa-release
Credhub-release
Spring data rest
Cloud foundry uaa-release
Spring boot
Spring batch admin
Mysql
Spring data commons
Spring cloud sso connector
Spring security oauth
Windows stemcells
Spring integration zip
Pivotal application service
Cloud foundry cf-deployment
Cloudfoundry uaa release
Cloudfoundry uaa
Spring batch
Spring integration
Spring web services
Concourse


Copyright 2019, cxsecurity.com

 

Back to Top