CVEvulnerability

CVE-2017-4963

8.1 HIGH Published 2017-06-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-06-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.1 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-384

Description

An issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier versions, UAA stand-alone release v2.0.0 - v2.7.4.12 & v3.0.0 - v3.11.0, and UAA bosh release v26 & earlier versions. UAA is vulnerable to session fixation when configured to authenticate against external SAML or OpenID Connect based identity providers.

Affected configurations

• pivotal software cloud foundry cf-release (<= 252) • pivotal software cloud foundry uaa (>= 2.0.0 <= 2.7.4.12) • pivotal software cloud foundry uaa (>= 3.0.0 <= 3.11.0) • pivotal software cloud foundry uaa-release (<= 26)

Related

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References