User Account Authentication Cloudfoundry User Account Authentication

Do you want an email whenever new security vulnerabilities are reported in Cloudfoundry User Account Authentication?

By the Year

In 2023 there have been 0 vulnerabilities in Cloudfoundry User Account Authentication . User Account Authentication did not have any published security vulnerabilities last year.

Year Vulnerabilities Average Score
2023 0 0.00
2022 0 0.00
2021 2 6.80
2020 1 8.80
2019 4 7.48
2018 0 0.00

It may take a day or so for new User Account Authentication vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Cloudfoundry User Account Authentication Security Vulnerabilities

UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability

CVE-2021-22098 6.1 - Medium - August 11, 2021

UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability. A malicious user can exploit the open redirect vulnerability by social engineering leading to take over of victims accounts in certain cases along with redirection of UAA users to a malicious sites.

Open Redirect

In UAA versions prior to 75.3.0

CVE-2021-22001 7.5 - High - July 22, 2021

In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider( IdP) of type oauth 1.0 was sent to UAA server.

In Cloud Foundry UAA

CVE-2020-5402 8.8 - High - February 27, 2020

In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers.

Session Riding

Cloud Foundry UAA Release

CVE-2019-11293 6.5 - Medium - December 06, 2019

Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters.

Insertion of Sensitive Information into Log File

Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcatâs access file

CVE-2019-11290 7.5 - High - November 26, 2019

Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcatâs access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.

Information Disclosure

CF UAA versions prior to 74.1.0, allow external input to be directly queried against

CVE-2019-11278 9.8 - Critical - September 26, 2019

CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft a SCIM query, which leaks information that allows an escalation of privileges, ultimately allowing the malicious user to gain control of UAA scopes they should not have.

Improper Input Validation

Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack

CVE-2019-11274 6.1 - Medium - August 09, 2019

Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that contains a SCIM filter that contains malicious JavaScript, which older browsers may execute.

XSS

The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0 through 1.6.13

CVE-2016-0732 8.8 - High - September 07, 2017

The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0 through 1.6.13 allows remote authenticated users with privileges in one zone to gain privileges and perform operations on a different zone via unspecified vectors.

Improper Privilege Management

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Cloudfoundry Cf Release or by Cloudfoundry? Click the Watch button to subscribe.

subscribe