CVEvulnerability
CVE-2017-4992
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-06-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-269
Description
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior to v2.7.4.17, 3.6.x versions prior to v3.6.11, 3.9.x versions prior to v3.9.13, and other versions prior to v4.2.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.15, 24.x versions prior to v24.10, 30.x versions prior to 30.3, and other versions prior to v37. There is privilege escalation (arbitrary password reset) with user invitations.
Affected configurations
• cloudfoundry cf-release (<= 260)
• cloudfoundry cloud foundry uaa bosh (<= 27)
• cloudfoundry cloud foundry uaa bosh 13.1
• cloudfoundry cloud foundry uaa bosh 13.2
• cloudfoundry cloud foundry uaa bosh 13.3
• cloudfoundry cloud foundry uaa bosh 13.4
• cloudfoundry cloud foundry uaa bosh 13.5
• cloudfoundry cloud foundry uaa bosh 13.6
• cloudfoundry cloud foundry uaa bosh 13.7
• cloudfoundry cloud foundry uaa bosh 13.8
• cloudfoundry cloud foundry uaa bosh 13.9
• cloudfoundry cloud foundry uaa bosh 13.10
• cloudfoundry cloud foundry uaa bosh 13.11
• cloudfoundry cloud foundry uaa bosh 13.12
• cloudfoundry cloud foundry uaa bosh 13.13
• cloudfoundry cloud foundry uaa bosh 13.14
• cloudfoundry cloud foundry uaa bosh 24
• cloudfoundry cloud foundry uaa bosh 24.1
• cloudfoundry cloud foundry uaa bosh 24.2
• cloudfoundry cloud foundry uaa bosh 24.3
• cloudfoundry cloud foundry uaa bosh 24.4
• cloudfoundry cloud foundry uaa bosh 24.5
• cloudfoundry cloud foundry uaa bosh 24.6
• cloudfoundry cloud foundry uaa bosh 24.7
• cloudfoundry cloud foundry uaa bosh 24.8
• cloudfoundry cloud foundry uaa bosh 24.9
• cloudfoundry cloud foundry uaa bosh 30
• cloudfoundry cloud foundry uaa bosh 30.1
• cloudfoundry cloud foundry uaa bosh 30.2
• pivotal software cloud foundry uaa (<= 4.2.0)
• pivotal software cloud foundry uaa 2.2.5.4
• pivotal software cloud foundry uaa 2.7.1
• pivotal software cloud foundry uaa 2.7.2
• pivotal software cloud foundry uaa 2.7.3
• pivotal software cloud foundry uaa 2.7.4
• pivotal software cloud foundry uaa 2.7.4.1
• pivotal software cloud foundry uaa 2.7.4.2
• pivotal software cloud foundry uaa 2.7.4.3
• pivotal software cloud foundry uaa 2.7.4.4
• pivotal software cloud foundry uaa 2.7.4.5
• pivotal software cloud foundry uaa 2.7.4.6
• pivotal software cloud foundry uaa 2.7.4.7
• pivotal software cloud foundry uaa 2.7.4.8
• pivotal software cloud foundry uaa 2.7.4.9
• pivotal software cloud foundry uaa 2.7.4.11
• pivotal software cloud foundry uaa 2.7.4.12
• pivotal software cloud foundry uaa 2.7.4.13
• pivotal software cloud foundry uaa 2.7.4.14
• pivotal software cloud foundry uaa 2.7.4.15
• pivotal software cloud foundry uaa 2.7.4.16
• pivotal software cloud foundry uaa 3.6.1
• pivotal software cloud foundry uaa 3.6.2
• pivotal software cloud foundry uaa 3.6.3
• pivotal software cloud foundry uaa 3.6.4
• pivotal software cloud foundry uaa 3.6.5
• pivotal software cloud foundry uaa 3.6.6
• pivotal software cloud foundry uaa 3.6.7
• pivotal software cloud foundry uaa 3.6.8
• pivotal software cloud foundry uaa 3.6.9
• pivotal software cloud foundry uaa 3.6.10
… and 13 more
Related
Weakness · CWE (1)
- CWE-269 Improper Privilege Management weakness
References
- https://www.cloudfoundry.org/cve-2017-4992/ Vendor Advisory
- https://www.cloudfoundry.org/cve-2017-4992/ Vendor Advisory