PT-2018-13182 · Cloud Foundry · Cloud Foundry Uaa

Florian Tack + 1 · Published 2018-12-13 · Updated 2019-10-09 · CVE-2018-15754

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 66.0

Description The issue concerns an authorization logic error in environments with multiple identity providers where accounts have the same username across different providers. A remote authenticated user with access to one account may be able to obtain a token for an account with the same username in another identity provider.

Recommendations For versions prior to 66.0, update to version 66.0 or later to resolve the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2018-15754

Affected Products

Cloud Foundry Uaa

References · 4

• https://cloudfoundry.org/blog/cve-2018-15754 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15754 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15754 · Vendor Advisory
• http://securityfocus.com/bid/106240 · Note