PT-2021-14841 · Uaa · Uaa

Klaus Kiefer · Published 2021-07-22 · Updated 2021-08-04 · CVE-2021-22001

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions UAA versions prior to 75.3.0

Description The issue concerns the revelation of sensitive information, such as the relaying secret of the provider, in response to a deletion request of an identity provider (IdP) of type "oauth 1.0" sent to the UAA server.

Recommendations For versions prior to 75.3.0, update to version 75.3.0 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-22001

Affected Products

Uaa

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-22001 · Security Note
• https://cloudfoundry.org/blog/cve-2021-22001-sensitive-info-leakage-in-uaa-during-identity-provider-deletion · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22001 · Vendor Advisory
• https://t.me/cibsecurity/26385 · Telegram Post