CVE-2021-22001: Sensitive info leakage in UAA during Identity Provider deletion | Cloud Foundry

Severity

Medium

Vendor

Cloud Foundry Foundation

Description

In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider( IdP) of type “oauth 1.0” was sent to UAA server.

An attacker can gain access to external IdPs via this leaked secret of UAA server.

Affected Cloud Foundry Products and Versions

Severity is medium unless otherwise noted.

• UAA Release
  • All versions prior to 75.3.0
• CF Deployment
  • All versions prior to 16.18.0

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

• UAA Release
  • Upgrade all versions to 75.3.0 or greater
• CF Deployment
  • Upgrade all versions to 16.18.0 or greater

Credit

This issue was responsibly reported by Klaus Kiefer from SAP.

History

2021-07-22: Initial vulnerability report published.