Lucene search

[email protected]CVE-2017-4963

HistoryJun 13, 2017 - 6:29 a.m.

CVE-2017-4963

2017-06-1306:29:00

CWE-384

[email protected]

web.nvd.nist.gov

cve

2017

4963

cloud foundry

uaa

session fixation

vulnerability

saml

openid connect

nvd

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.8%

JSON

An issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier versions, UAA stand-alone release v2.0.0 - v2.7.4.12 & v3.0.0 - v3.11.0, and UAA bosh release v26 & earlier versions. UAA is vulnerable to session fixation when configured to authenticate against external SAML or OpenID Connect based identity providers.

Affected configurations

NVD

Node

pivotal_softwarecloud_foundry_cf-releaseRange≤252

pivotal_softwarecloud_foundry_uaaRange2.0.0–2.7.4.12

pivotal_softwarecloud_foundry_uaaRange3.0.0–3.11.0

pivotal_softwarecloud_foundry_uaa-releaseRange≤26bosh

CPENameOperatorVersion
pivotal_software:cloud_foundry_cf-releasepivotal software cloud foundry cf-releasele252
pivotal_software:cloud_foundry_uaapivotal software cloud foundry uaale2.7.4.12
pivotal_software:cloud_foundry_uaapivotal software cloud foundry uaale3.11.0
pivotal_software:cloud_foundry_uaa-releasepivotal software cloud foundry uaa-releasele26

CPE	Name	Operator	Version
pivotal_software:cloud_foundry_cf-release	pivotal software cloud foundry cf-release	le	252
pivotal_software:cloud_foundry_uaa	pivotal software cloud foundry uaa	le	2.7.4.12
pivotal_software:cloud_foundry_uaa	pivotal software cloud foundry uaa	le	3.11.0
pivotal_software:cloud_foundry_uaa-release	pivotal software cloud foundry uaa-release	le	26

CNA Affected

[
  {
    "product": "Cloud Foundry Foundation",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cloud Foundry Foundation"
      }
    ]
  }
]

References

www.cloudfoundry.org/cve-2017-4963/

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.8%

JSON

Related for CVE-2017-4963

prion1 veracode1 cloudfoundry1 osv1 cvelist1 nvd1