Comparison Using Wrong Factors

Overview org.cloudfoundry.identity:cloudfoundry-identity-server is a Cloud Foundry User Account and Authentication UAA Server. Affected versions of this package are vulnerable to Comparison Using Wrong Factors due to a logic error in the token revocation endpoint implementation. An attacker can...

Information Disclosure

cloudfoundry-identity-server is vulnerable to information disclosure. A remotely authenticated attacker with scim.invite scope is able to obtain information about users of the UAA via blind SCIM injection through the email parameter...

Privilege Escalation

cloudfoundry-identity-server is vulnerable to privilege escalation. External input is directly appended to an SCIM query, allowing a remote attacker with client.write and groups.update to inject and execute a malicious SCIM query. This allows the retrieval of confidential information that allows ...

Privilege Escalation

cloudfoundry-identity-server is vulnerable to privilege escalation attacks. The vulnerability exists due to an error in validation, allowing an authenticated user to gain an OAuth token with arbitrary scopes by modifying the url and content of the consent page...

Authorization Bypass

cloudfoundry-identity-server is vulnerable to authorization bypasses. A malicious user can use a refresh token to gain access to the application instead of using an access token, allowing them to stay authenticated longer...

Forwarded HTTP Headers

cloudfoundry-identity-server is vulnerable to forwarded http headers. There is an issue with forwarded http headers in UAA that can result in an account being corrupted...