11 results (0.007 seconds)

CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0

CVE-2019-11282 – UAA is vulnerable to a Blind SCIM injection leading to information disclosure

https://notcve.org/view.php?id=CVE-2019-11282

Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of the UAA. Cloud Foundry UAA, versiones anteriores a v74.3.0, contiene un endpoint que es vulnerable al ataque de inyección SCIM. Un usuario malicioso autenticado remoto con alcance de scim.invite puede diseñar una petición con contenido malicioso que puede filtrar información sobre los usuarios de la UAA. • https://www.cloudfoundry.org/blog/cve-2019-11282 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0

CVE-2019-11270 – UAA clients.write vulnerability

https://notcve.org/view.php?id=CVE-2019-11270

Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess. Cloud Foundry UAA versiones anteriores a v73.4.0, contienen una vulnerabilidad en la que un cliente malicioso bajo posesión de la autoridad o el alcance "clients.write" puede omitir las restricciones impuestas a los clientes creados por medio de "clients.write" y crear clientes con alcances arbitrarios que no poseen. • https://pivotal.io/security/cve-2019-11270 https://www.cloudfoundry.org/blog/cve-2019-11270 • CWE-269: Improper Privilege Management CWE-732: Incorrect Permission Assignment for Critical Resource •

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2019-3794 – UAA - Login app subject to clickjacking attack

https://notcve.org/view.php?id=CVE-2019-3794

Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites. Cloud Foundry UAA, versiones anteriores a v73.4.0, no establece un encabezado X-FRAME-OPTIONS en varios puntos finales. Un usuario remoto puede realizar ataques de clickjacking en los sitios front-end de UAA. • https://www.cloudfoundry.org/blog/cve-2019-3794 • CWE-284: Improper Access Control CWE-1021: Improper Restriction of Rendered UI Layers or Frames •

CVSS: 9.9EPSS: 0%CPEs: 2EXPL: 0

CVE-2018-15761 – UAA Privilege Escalation

https://notcve.org/view.php?id=CVE-2018-15761

Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their privileges. Cloud Foundry UAA release, en versiones anteriores a la v64.0, y UAA, en versiones anteriores a la 4.23.0, contiene un error de validación que permite el escalado de privilegios. Un usuario autenticado remoto podría modificar la URL y el contenido de una página de consentimiento para obtener un token con alcances arbitrarios que escala sus privilegios. • https://www.cloudfoundry.org/blog/cve-2018-15761 •

CVSS: 7.2EPSS: 0%CPEs: 66EXPL: 0

CVE-2017-4991

https://notcve.org/view.php?id=CVE-2017-4991

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3.6.10, 3.9.x versions prior to v3.9.12, and other versions prior to v3.17.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.14, 24.x versions prior to v24.9, 30.x versions prior to 30.2, and other versions prior to v36. Privileged users in one zone are allowed to perform a password reset for users in a different zone. Se detectó un problema en cf-release versiones anteriores a 260; UAA release versiones 2.x anteriores a 2.7.4.16, versiones 3.6.x anteriores a 3.6.10, versiones 3.9.x anteriores a 3.9.12, y otras versiones anteriores a 3.17.0; y UAA bosh release (uaa-release) versiones 13.x anteriores a 13.14, versiones 24.x anteriores a 24.9, versiones 30.x anterior a 30.2, y otras versiones anteriores a 36 de Cloud Foundry Foundation. Los usuarios con privilegios de una zona pueden realizar un restablecimiento de contraseña por los usuarios de una zona diferente. • https://www.cloudfoundry.org/cve-2017-4991 • CWE-269: Improper Privilege Management •