CVEvulnerability

CVE-2017-4994

7.5 HIGH Published 2017-06-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-06-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-20

Description

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v263; UAA release 2.x versions prior to v2.7.4.18, 3.6.x versions prior to v3.6.12, 3.9.x versions prior to v3.9.14, and other versions prior to v4.3.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.16, 24.x versions prior to v24.11, 30.x versions prior to 30.4, and other versions prior to v40. There was an issue with forwarded http headers in UAA that could result in account corruption.

Affected configurations

• cloudfoundry cloud foundry uaa bosh (<= 39) • cloudfoundry cloud foundry uaa bosh 13.1 • cloudfoundry cloud foundry uaa bosh 13.2 • cloudfoundry cloud foundry uaa bosh 13.3 • cloudfoundry cloud foundry uaa bosh 13.4 • cloudfoundry cloud foundry uaa bosh 13.5 • cloudfoundry cloud foundry uaa bosh 13.6 • cloudfoundry cloud foundry uaa bosh 13.7 • cloudfoundry cloud foundry uaa bosh 13.8 • cloudfoundry cloud foundry uaa bosh 13.9 • cloudfoundry cloud foundry uaa bosh 13.10 • cloudfoundry cloud foundry uaa bosh 13.11 • cloudfoundry cloud foundry uaa bosh 13.12 • cloudfoundry cloud foundry uaa bosh 13.13 • cloudfoundry cloud foundry uaa bosh 13.14 • cloudfoundry cloud foundry uaa bosh 13.15 • cloudfoundry cloud foundry uaa bosh 24 • cloudfoundry cloud foundry uaa bosh 24.1 • cloudfoundry cloud foundry uaa bosh 24.2 • cloudfoundry cloud foundry uaa bosh 24.3 • cloudfoundry cloud foundry uaa bosh 24.4 • cloudfoundry cloud foundry uaa bosh 24.5 • cloudfoundry cloud foundry uaa bosh 24.6 • cloudfoundry cloud foundry uaa bosh 24.7 • cloudfoundry cloud foundry uaa bosh 24.8 • cloudfoundry cloud foundry uaa bosh 24.9 • cloudfoundry cloud foundry uaa bosh 24.10 • cloudfoundry cloud foundry uaa bosh 30 • cloudfoundry cloud foundry uaa bosh 30.1 • cloudfoundry cloud foundry uaa bosh 30.2 • cloudfoundry cloud foundry uaa bosh 30.3 • pivotal software cloud foundry cf (<= 262) • pivotal software cloud foundry uaa (<= 4.2.0) • pivotal software cloud foundry uaa 2.2.5.4 • pivotal software cloud foundry uaa 2.7.1 • pivotal software cloud foundry uaa 2.7.2 • pivotal software cloud foundry uaa 2.7.3 • pivotal software cloud foundry uaa 2.7.4 • pivotal software cloud foundry uaa 2.7.4.1 • pivotal software cloud foundry uaa 2.7.4.2 • pivotal software cloud foundry uaa 2.7.4.3 • pivotal software cloud foundry uaa 2.7.4.4 • pivotal software cloud foundry uaa 2.7.4.5 • pivotal software cloud foundry uaa 2.7.4.6 • pivotal software cloud foundry uaa 2.7.4.7 • pivotal software cloud foundry uaa 2.7.4.8 • pivotal software cloud foundry uaa 2.7.4.9 • pivotal software cloud foundry uaa 2.7.4.11 • pivotal software cloud foundry uaa 2.7.4.12 • pivotal software cloud foundry uaa 2.7.4.13 • pivotal software cloud foundry uaa 2.7.4.14 • pivotal software cloud foundry uaa 2.7.4.15 • pivotal software cloud foundry uaa 2.7.4.16 • pivotal software cloud foundry uaa 2.7.4.17 • pivotal software cloud foundry uaa 3.6.1 • pivotal software cloud foundry uaa 3.6.2 • pivotal software cloud foundry uaa 3.6.3 • pivotal software cloud foundry uaa 3.6.4 • pivotal software cloud foundry uaa 3.6.5 • pivotal software cloud foundry uaa 3.6.6 … and 18 more

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References