High severity · published Dec 13, 2018
CVE-2018-15754
Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error
8.8
CVSS
1.8%
EPSS
No
On KEV
Description
Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts across identity providers with the same username, a remote authenticated user with access to one of these accounts may be able to obtain a token for an account of the same username in the other identity provider.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cloud Foundry Uaa-release · Pivotal Software
60.0 before 66.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-15754
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-15754
Third Party Advisory
http://www.securityfocus.com/bid/106240
Mitigation
https://www.cloudfoundry.org/blog/cve-2018-15754
Mitigation
https://www.cloudfoundry.org/blog/cve-2018-15754/
More from Cloud Foundry Uaa-release
8.8
CVE-2019-3787
Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @…
8.8
CVE-2018-1192
In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x…
8.1
CVE-2017-4963
An issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier versions, UAA stand-alone release v2.0.0 - v2.7.4.12 & v3.0.0 - v3.11.0, and UAA bosh…
7.2
CVE-2018-1262
Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline…
6.1
CVE-2018-11041
Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not…