CVE-2018-15761critical

CVE-2018-15761: falha crítica em Cloud Foundry UAA

UAA Privilege Escalation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar UAA+ Monitorar org.cloudfoundry.identity:cloudfoundry-identity-server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.9epss 1.7%
Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their privileges.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Cloud Foundry · UAACloud Foundry · UAA Release
CVEs relacionadas — Cloud Foundry UAA

No mesmo produto, das mais perigosas para as menos.

CVE-2018-15754MEDIUMUAA can issue tokens across identity providers if users with matching usernames existEPSS 1.8%CVE-2019-11293HIGHUAA logs all query parameters with debug logging levelEPSS 1.3%CVE-2019-11290HIGHCloud Foundry UAA logs query parameters in tomcat access fileEPSS 1.3%CVE-2019-11282MEDIUMUAA is vulnerable to a Blind SCIM injection leading to information disclosureEPSS 1.1%CVE-2018-11082MEDIUMCloud Foundry UAA MFA does not prevent brute force of MFA codeEPSS 1.1%CVE-2026-59335HIGHCase-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA CompromiseEPSS 0.5%