Lucene search

GitHub Advisory DatabaseGHSA-CGRG-X34R-78F3

HistoryMay 13, 2022 - 1:07 a.m.

Cloud Foundry UAA password reset vulnerability

2022-05-1301:07:26

CWE-269

GitHub Advisory Database

github.com

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

42.9%

JSON

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3.6.10, 3.9.x versions prior to v3.9.12, and other versions prior to v3.17.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.14, 24.x versions prior to v24.9, 30.x versions prior to 30.2, and other versions prior to v36. Privileged users in one zone are allowed to perform a password reset for users in a different zone.

Affected configurations

Vulners

Node

wso2identity_serverRange<3.17.0

wso2identity_serverRange<3.9.12

wso2identity_serverRange<3.6.10

wso2identity_serverRange<2.7.4.16

CPENameOperatorVersion
org.cloudfoundry.identity:cloudfoundry-identity-serverlt3.17.0
org.cloudfoundry.identity:cloudfoundry-identity-serverlt3.9.12
org.cloudfoundry.identity:cloudfoundry-identity-serverlt3.6.10
org.cloudfoundry.identity:cloudfoundry-identity-serverlt2.7.4.16

Name	Operator	Version
org.cloudfoundry.identity:cloudfoundry-identity-server	lt	3.17.0
org.cloudfoundry.identity:cloudfoundry-identity-server	lt	3.9.12
org.cloudfoundry.identity:cloudfoundry-identity-server	lt	3.6.10
org.cloudfoundry.identity:cloudfoundry-identity-server	lt	2.7.4.16

References

github.com/advisories/GHSA-cgrg-x34r-78f3

github.com/cloudfoundry/uaa/commit/2ca35f1723e039aa7d2318134b05d02e40072a18

github.com/cloudfoundry/uaa/commit/ba23bcf109704ab2eae519b705d7b2a75e023553

github.com/cloudfoundry/uaa/commit/bbf6751bc0d87c4a3aaf21b54e26ce328ab998b3

github.com/cloudfoundry/uaa/commit/eb3f86054489039e11eabd54a8ec9a46c22abfc8

nvd.nist.gov/vuln/detail/CVE-2017-4991

www.cloudfoundry.org/cve-2017-4991

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

42.9%

JSON

Related for GHSA-CGRG-X34R-78F3