PT-2024-28228 · Cloud Foundry Foundation · Cloud Foundry

Rohit04061992 · Published 2024-07-18 · Updated 2024-07-19 · CVE-2024-38806

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Low

Base vector

AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Cloud Foundry Foundation version v40.17.0

Description The issue is related to a failure in properly synchronizing a user's permissions in the User Account and Authentication (UAA) system. This potentially results in users retaining access rights they should not have, allowing them to perform operations beyond their intended permissions.

Recommendations For Cloud Foundry Foundation version v40.17.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-440

Related Identifiers

CVE-2024-38806

Affected Products

Cloud Foundry

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-38806 · Security Note
• https://t.me/cvedetector/1176 · Telegram Post
• https://cloudfoundry.org/blog/cve-2024-38806-uaa-failure-to-remove-shadow-users-access · Note