PT-2018-11292 · Cloud Foundry Foundation · Cloud Foundry Uaa

Publicado 2018-05-15 · Atualizado 2022-05-13 · CVE-2018-1262

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry Foundation UAA versions 4.12.X through 4.13.X

Description The issue allows for privilege escalation across identity zones for clients performing offline validation. A zone administrator could configure their zone to issue tokens which impersonate another zone, granting up to admin privileges in the impersonated zone for clients performing offline token validation.

Recommendations For Cloud Foundry Foundation UAA versions 4.12.X through 4.13.X, consider restricting the ability to configure zones to issue impersonating tokens until a fix is available. As a temporary workaround, limit the privileges granted to tokens issued for offline validation to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2018-1262

GHSA-8V97-GV3G-32RF

Produtos afetados

Cloud Foundry Uaa

Referências · 7

• https://github.com/cloudfoundry/uaa · Nota
• https://github.com/cloudfoundry/uaa/commit/14c745aa293b8d3ce9cdd6bfbc6c0ef3f269b21 · Nota
• https://github.com/cloudfoundry/uaa/commit/dccd3962f969913996ee88f653fce3b108c0205 · Nota
• https://cloudfoundry.org/blog/cve-2018-1262 · Nota
• https://osv.dev/vulnerability/GHSA-8v97-gv3g-32rf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1262 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1262 · Aviso do Fabricante