HIGH🇵🇱 Wersja polska

CVE-2018-1262

CVSS 7.2v3.0pub. 2018-05-15upd. 2024-11-21

Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline validation. A zone administrator could configure their zone to issue tokens which impersonate another zone, granting up to admin privileges in the impersonated zone for clients performing offline token validation.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Cloudfoundry Cf Deployment

    APP
    Cloudfoundry
    1.27.0 – 1.31.0

  • Pivotal Software Cloud Foundry Uaa

    APP
    Pivotal Software
    4.12.04.12.14.12.24.13.04.13.14.13.24.13.34.13.4

  • Pivotal Software Cloud Foundry Uaa Release

    APP
    Pivotal Software
    5757.158
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
LPE
CWE
References

Related vulnerabilities

CVE-2022-31733CRITICAL9.1PL ✓same product

Cloudfoundry Diego — pominięcie uwierzytelniania mTLS przez niezabezpieczony port

CVE-2019-3801CRITICAL9.8PL ✓same product

Cloud Foundry cf-deployment: wstrzyknięcie kodu przez niezaszyfrowany protokół pobierania zależności

CVE-2018-15761CRITICAL9.9PL ✓same product

Privilege escalation w Cloud Foundry UAA poprzez manipulację stroną zgody

CVE-2015-5171CRITICAL9.8PL ✓same product

Cloud Foundry: brak unieważniania sesji po zmianie hasła

CVE-2015-5172CRITICAL9.8PL ✓same product

Cloud Foundry: brak wygasania linków resetowania hasła