PT-2018-11292 · Cloud Foundry Foundation · Cloud Foundry Uaa

Published 2018-05-15 · Updated 2022-05-13 · CVE-2018-1262

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry Foundation UAA versions 4.12.X through 4.13.X

Description The issue allows for privilege escalation across identity zones for clients performing offline validation. A zone administrator could configure their zone to issue tokens which impersonate another zone, granting up to admin privileges in the impersonated zone for clients performing offline token validation.

Recommendations For Cloud Foundry Foundation UAA versions 4.12.X through 4.13.X, consider restricting the ability to configure zones to issue impersonating tokens until a fix is available. As a temporary workaround, limit the privileges granted to tokens issued for offline validation to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2018-1262

GHSA-8V97-GV3G-32RF

Affected Products

Cloud Foundry Uaa

References · 7

• https://osv.dev/vulnerability/GHSA-8v97-gv3g-32rf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1262 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1262 · Vendor Advisory
• https://github.com/cloudfoundry/uaa · Note
• https://github.com/cloudfoundry/uaa/commit/14c745aa293b8d3ce9cdd6bfbc6c0ef3f269b21 · Note
• https://github.com/cloudfoundry/uaa/commit/dccd3962f969913996ee88f653fce3b108c0205 · Note
• https://cloudfoundry.org/blog/cve-2018-1262 · Note