RSS   Podatności dla
'User account and authentication'
   RSS

2020-02-27
 
CVE-2020-5402

CWE-352
 

 
In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers.

 
2019-12-06
 
CVE-2019-11293

CWE-532
 

 
Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters.

 
2019-11-26
 
CVE-2019-11290

CWE-200
 

 

 
2019-09-26
 
CVE-2019-11278

CWE-20
 

 
CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft a SCIM query, which leaks information that allows an escalation of privileges, ultimately allowing the malicious user to gain control of UAA scopes they should not have.

 
2019-08-09
 
CVE-2019-11274

CWE-79
 

 
Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that contains a SCIM filter that contains malicious JavaScript, which older browsers may execute.

 

 >>> Vendor: Cloudfoundry 17 Produkty
Capi-release
Cf-release
Cf-mysql-release
Routing-release
Bosh azure cpi
Uaa release
Routing release
Cf-deployment
Garden-runc
Staticfile buildpack
User account and authentication
Container runtime
Command line interface
Credhub cli
Stratos
Bosh backup and restore
Cloud controller


Copyright 2020, cxsecurity.com

 

Back to Top