CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1264 – Log Cache logs UAA client secret on startup
https://notcve.org/view.php?id=CVE-2018-1264
05 Oct 2018 — Cloud Foundry Log Cache, versions prior to 1.1.1, logs its UAA client secret on startup as part of its envstruct report. A remote attacker who has gained access to the Log Cache VM can read this secret, gaining all privileges held by the Log Cache UAA client. In the worst case, if this client is an admin, the attacker would gain complete control over the Foundation. Cloud Foundry Log Cache, en versiones anteriores a la 1.1.1, registra el secreto UAA del cliente al arranque como parte de su informe envstruct... • https://www.cloudfoundry.org/blog/cve-2018-1264 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 5.9EPSS: 0%CPEs: 3EXPL: 0CVE-2016-0715
https://notcve.org/view.php?id=CVE-2016-0715
11 Sep 2018 — Pivotal Cloud Foundry Elastic Runtime version 1.4.0 through 1.4.5, 1.5.0 through 1.5.11 and 1.6.0 through 1.6.11 is vulnerable to a remote information disclosure. It was found that original mitigation configuration instructions provided as part of CVE-2016-0708 were incomplete and could leave PHP Buildpack, Staticfile Buildpack and potentially other custom Buildpack applications vulnerable to remote information disclosure. Affected applications use automated buildpack detection, serve files directly from th... • https://pivotal.io/security/cve-2016-0715 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-11047
https://notcve.org/view.php?id=CVE-2018-11047
24 Jul 2018 — Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly authorizes requests to admin endpoints by accepting a valid refresh token in lieu of an access token. Refresh tokens by design have a longer expiration time than access tokens, allowing the possessor of a refresh token to authenticate longer than expected. This affects the administrative endpoints of the UAA. i.e. /Users, /Groups, etc. However, if the ... • https://www.cloudfoundry.org/blog/cve-2018-11047 • CWE-863: Incorrect Authorization •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2018-11041
https://notcve.org/view.php?id=CVE-2018-11041
25 Jun 2018 — Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open redirects. A remote attacker can craft a malicious link that, when clicked, will redirect users to arbitrary websites after a successful login attempt. Cloud Foundry UAA, en versiones posteriores a la 4.6.0 y anteriores... • https://www.cloudfoundry.org/blog/cve-2018-11041 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1265
https://notcve.org/view.php?id=CVE-2018-1265
06 Jun 2018 — Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers. A remote attacker with CF admin privileges can upload a malicious buildpack that will allow a complete takeover of a Diego Cell VM and access to all apps running on that Diego Cell. Cloud Foundry Diego, en versiones anteriores a la 2.8.0, no sanea correctamente las rutas de archivo en las cabeceras de archivos tar y zip. Un atacante remoto con privilegios de administrador CF puede subir ... • https://www.cloudfoundry.org/blog/cve-2018-1265 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.2EPSS: 0%CPEs: 12EXPL: 0CVE-2018-1262
https://notcve.org/view.php?id=CVE-2018-1262
15 May 2018 — Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline validation. A zone administrator could configure their zone to issue tokens which impersonate another zone, granting up to admin privileges in the impersonated zone for clients performing offline token validation. Cloud Foundry Foundation UAA, en versiones 4.12.X y 4.13.X, introdujo una característica que podría permitir el escalado de pri... • https://www.cloudfoundry.org/blog/cve-2018-1262 •
CVSS: 9.6EPSS: 0%CPEs: 4EXPL: 0CVE-2016-6658
https://notcve.org/view.php?id=CVE-2016-6658
29 Mar 2018 — Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpack. Although it is not recommended, a user can specify a credential in the URL (basic auth or OAuth) to access the buildpack through the CLI. For example, the user could include a GitHub username and password in the URL to access a private repo. Because the URL to access the buildpack is stored unencrypted, an operator with privileged access to the Cloud Controller data... • https://pivotal.io/security/cve-2016-6658 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 3%CPEs: 2EXPL: 0CVE-2016-9880
https://notcve.org/view.php?id=CVE-2016-9880
16 Mar 2018 — The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used to gain access to the cluster managed by the broker. El broker GemFire para Cloud Foundry, en versiones 1.6.x anteriores a la 1.6.5 y versiones 1.7.x anteriores a la 1.7.1, tiene múltiples endpoints de API que no requieren autenticación y que podrían usarse para obtener acceso al clúster gestionado por el broker. • http://www.securityfocus.com/bid/96146 • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2018-1192
https://notcve.org/view.php?id=CVE-2018-1192
01 Feb 2018 — In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x versions prior to 4.7.4; and UAA-release 45.7.x versions prior to 45.7, 52.7.x versions prior to 52.7, and 53.3.x versions prior to 53.3, the SessionID is logged in audit event logs. An attacker can use the SessionID to impersonate a logged-in user. En Cloud Foundry Foundation cf-release en versiones anteriores a v285; cf-deployment ... • https://www.cloudfoundry.org/blog/cve-2018-1192 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2015-5170
https://notcve.org/view.php?id=CVE-2015-5170
24 Oct 2017 — Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery (CSRF) attacks on PWS and log a user into an arbitrary account by leveraging lack of CSRF checks. Cloud Foundry Runtime cf-release en versiones anteriores a la 216, UAA en versiones anteriores a la 2.5.2 y Pivotal Cloud Foundry (PCF) Elastic Runtime en versiones anteriores a la 1.7.0 permite que atacantes remotos realicen ata... • http://www.securityfocus.com/bid/101579 • CWE-352: Cross-Site Request Forgery (CSRF) •