CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2015-5171
https://notcve.org/view.php?id=CVE-2015-5171
The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire existing sessions. La funcionalidad de cambio de contraseña en Cloud Foundry Runtime cf-release en versiones anteriores a la 216, UAA en versiones anteriores a la 2.5.2 y Pivotal Cloud Foundry (PCF) Elastic Runtime en versiones anteriores a la 1.7.0 permite que los atacantes causen un impacto no especificado aprovechando que no caducan las sesiones existentes. • https://pivotal.io/security/cve-2015-5170-5173 • CWE-613: Insufficient Session Expiration •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2015-5172
https://notcve.org/view.php?id=CVE-2015-5172
Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links. Cloud Foundry Runtime cf-release en versiones anteriores a la 216, UAA en versiones anteriores a la 2.5.2 y Pivotal Cloud Foundry (PCF) Elastic Runtime en versiones anteriores a la 1.7.0 permite que atacantes causen un impacto no especificado aprovechando que no caducan los enlaces de reinicio de contraseña. • https://pivotal.io/security/cve-2015-5170-5173 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 8.8EPSS: 0%CPEs: 51EXPL: 0CVE-2016-0732
https://notcve.org/view.php?id=CVE-2016-0732
The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0 through 1.6.13 allows remote authenticated users with privileges in one zone to gain privileges and perform operations on a different zone via unspecified vectors. La característica de zonas de identidad en Pivotal Cloud Foundry 208 a 229; UAA 2.0.0 a 2.7.3 y 3.0.0; UAA-Release 2 hasta la 4, cuando se configura con múltiples zonas de identidad; y Elastic Runtime 1.6.0 hasta la 1.6.13 permite que los usuarios remotos autenticados con privilegios en una zona obtengan privilegios y realicen operaciones en una zona diferente mediante vectores no especificados. • https://pivotal.io/security/cve-2016-0732 • CWE-269: Improper Privilege Management •
CVSS: 6.6EPSS: 0%CPEs: 81EXPL: 0CVE-2017-8032
https://notcve.org/view.php?id=CVE-2017-8032
In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions prior to v3.9.15, 3.20.x versions prior to v3.20.0, and other versions prior to v4.4.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.17, 24.x versions prior to v24.12. 30.x versions prior to 30.5, and other versions prior to v41, zone administrators are allowed to escalate their privileges when mapping permissions for an external provider. En cf-release de Cloud Foundry versiones anteriores a 264; UAA libera todas las versiones de UAA v2.x.x, versión 3.6.x anteriores a 3.6.13, versión 3.9.x anteriores a 3.9.15, versiones 3.20.x anteriores a v3.20.0, y otras versiones anteriores a v4.4.0; y versiones de UAA bosh release (uaa-release) versión 13.x anteriores a v13.17, versión 24.x anteriores a 24.12. 30.x versiones anteriores a 30.5, y otras versiones anteriores a 41, los administradores de zona pueden escalar sus privilegios al asignar permisos para un proveedor externo. • https://www.cloudfoundry.org/cve-2017-8032 • CWE-269: Improper Privilege Management •
CVSS: 8.8EPSS: 0%CPEs: 58EXPL: 0CVE-2017-4973
https://notcve.org/view.php?id=CVE-2017-4973
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prior to v3.15.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.12, 24.x versions prior to v24.7, and other versions prior to v30. A vulnerability has been identified with the groups endpoint in UAA allowing users to elevate their privileges. Se detectó un problema en cf-release versiones anteriores a v257; UAA release versiones 2.x anteriores a v2.7.4.14, versiones 3.6.x anteriores a v3.6.8, versiones 3.9.x anteriores a v3.9.10, y otras versiones anteriores a v3.15.0; y UAA bosh release (uaa-release) versiones 13.x anteriores a v13.12, versiones 24.x anteriores a v24.7, y otras versiones anteriores a v30 de Cloud Foundry Foundation. Se ha identificado una vulnerabilidad con el endpoint groups en UAA permitiendo a los usuarios elevar sus privilegios. • https://www.cloudfoundry.org/cve-2017-4973 • CWE-269: Improper Privilege Management •