CVE Feed

    Dashboard / CVE / CVE-2018-15754

    CVE-2018-15754

    Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts across identity providers with the same username, a remote authenticated user with access to one of these accounts may be able to obtain a token for an account of the same username in the other identity provider.

    Published:Dec 13, 2018
    Last Modified:Nov 21, 2024
    EPS:Dec 13, 2018
    EPSS Score:0.00417
    CVSS Score:4.2

    Affected Products

    Vendor
    Pivotal Software
    Product
    Cloud Foundry Uaa-release

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-863 Incorrect Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2019-11268 (CVSS 4.3) — Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated…
    CVE-2019-3787 (CVSS 8.3) — Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address w…
    CVE-2018-11041 (CVSS 6.1) — Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versi…
    CVE-2018-1262 (CVSS 7.2) — Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege esc…
    CVE-2018-1192 (CVSS 8.8) — In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x…
    CVE-2017-4963 (CVSS 8.1) — An issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier versions, UAA stand…
    CVE-2016-5016 (CVSS 5.9) — Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High