CPE Details
Pivotal Software Cloud Foundry uaa-release 64.0 for BOSH
64.0
2019-07-15
13h35 +00:00
13h35 +00:00
2021-04-26
13h32 +00:00
13h32 +00:00
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
CPE Name: cpe:2.3:a:pivotal_software:cloud_foundry_uaa-release:64.0:*:*:*:*:bosh:*:*
Informations
Vendor
pivotal_softwareProduct
cloud_foundry_uaa-releaseVersion
64.0Target Software
boshRelated CVE
| CVE ID | Published | Description | Score | Severity |
|---|---|---|---|---|
| Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and groups in all other identity zones. | 4.3 |
Medium |
||
| Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent to a potentially fraudulent address. This would allow the attacker to gain complete control of the user's account. | 8.8 |
High |
||
| Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts across identity providers with the same username, a remote authenticated user with access to one of these accounts may be able to obtain a token for an account of the same username in the other identity provider. | 8.8 |
High |
