HIGH🇵🇱 Wersja polska

CVE-2017-4963

CVSS 8.1v3.0pub. 2017-06-13upd. 2026-05-13

An issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier versions, UAA stand-alone release v2.0.0 - v2.7.4.12 & v3.0.0 - v3.11.0, and UAA bosh release v26 & earlier versions. UAA is vulnerable to session fixation when configured to authenticate against external SAML or OpenID Connect based identity providers.

CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Pivotal Software Cloud Foundry Cf Release

    APP
    Pivotal Software
    ≤ 252

  • Pivotal Software Cloud Foundry Uaa

    APP
    Pivotal Software
    2.0.0 – 2.7.4.123.0.0 – 3.11.0

  • Pivotal Software Cloud Foundry Uaa Release

    APP
    Pivotal Software
    ≤ 26
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2018-15761CRITICAL9.9PL ✓same product

Privilege escalation w Cloud Foundry UAA poprzez manipulację stroną zgody

CVE-2015-5171CRITICAL9.8PL ✓same product

Cloud Foundry: brak unieważniania sesji po zmianie hasła

CVE-2015-5172CRITICAL9.8PL ✓same product

Cloud Foundry: brak wygasania linków resetowania hasła

CVE-2017-4992CRITICAL9.8PL ✓same product

Cloud Foundry UAA: privilege escalation przez mechanizm zaproszeń użytkowników

CVE-2016-6637CRITICAL9.6PL ✓same product

CSRF w Pivotal Cloud Foundry UAA — przejęcie uprawnień użytkownika