CVEvulnerability
CVE-2018-15754
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-12-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 4.2 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-863
Description
Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts across identity providers with the same username, a remote authenticated user with access to one of these accounts may be able to obtain a token for an account of the same username in the other identity provider.
Affected configurations
• pivotal software cloud foundry uaa-release (>= 60.0 < 66.0)
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- http://www.securityfocus.com/bid/106240 Third Party Advisory, VDB Entry
- https://www.cloudfoundry.org/blog/cve-2018-15754 Mitigation, Vendor Advisory
- https://www.cloudfoundry.org/blog/cve-2018-15754/ Mitigation, Vendor Advisory
- http://www.securityfocus.com/bid/106240 Third Party Advisory, VDB Entry
- https://www.cloudfoundry.org/blog/cve-2018-15754 Mitigation, Vendor Advisory
- https://www.cloudfoundry.org/blog/cve-2018-15754/ Mitigation, Vendor Advisory