79 matches found
Clickjacking
cloudfoundry-identity-server is vulnerable to clickjacking attacks. It was discovered that it does not use content security policy X-FRAME-OPTIONS header on various email-endpoints which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into...
Information Disclosure
cloudfoundry-identity-server is vulnerable to information disclosure. The vulnerability exists as it defaults to sending emails to @unknown.org if a user's email address is not provided, allowing the owner of the unknown.org domain to receive password recovery emails of other users...
Man-in-the-Middle (MitM)
github.com/cloudfoundry/cf-deployment is vulnerable to man-in-the-middle attacks. Dependencies are downloaded via an unencrypted HTTP channel, allowing man-in-the-middle attackers to modify contents of the dependencies that are downloaded by the application, potentially causing arbitrary code...
Open Redirection
Cloudfoundry UAA is vulnerable to open redirection.The redirect URI is not properly validated to filter wildcard characters, allowing a remote unauthenticated user to enter malicious URI to get a UAA access code...
Privilege Escalation
cloudfoundry-identity-server is vulnerable to privilege escalation attacks. The vulnerability exists due to an error in validation, allowing an authenticated user to gain an OAuth token with arbitrary scopes by modifying the url and content of the consent page...
Authorization Bypass
cloudfoundry-identity-server is vulnerable to authorization bypasses. A malicious user can use a refresh token to gain access to the application instead of using an access token, allowing them to stay authenticated longer...
Man-in-the-Middle (MitM)
github.com/cloudfoundry/gorouter is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists due to the lack of validation on the value of the X-Forwarded-Proto header, allowing the client to use a http connection and be prone to MitM attacks...
Privilege Escalation
CloudFoundry User Account and Authentication UAA is vulnerable to privilege escalation. A zone administrator can issue a token that impersonates another zone, allowing an escalation of privileges during offline validation of clients...
File Traversal
github.com/cloudfoundry-attic/garden-linux is vulnerable to file traversal attacks. The garden-linux nstar executable allows attackers to read files within the host system that the BOSH-created vcap user has permission to read. This can be done by staging an application on Cloud Foundry using Die...
Cross-site Scripting (XSS)
cloudfoundry-identity-uaa is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary Javascript through the clientId parameter of a request to the UAA OpenID Connect check session iframe endpoint...
Denial Of Service (DoS) Through Token Revocation
CloudFoundry User Account and Authentication UAA is vulnerable to denial of service DoS attacks. The checktoken endpoint does not validate the clientId when revoking opaque or JWT client tokens, allowing a malicious user to revoke another user's token...
Privilege Escalation
CloudFoundry User Account and Authentication UAA is vulnerable to privilege escalation. There is a flaw in mapping permissions for an external provider, allowing Zone administrators to escalate their privileges...
Forwarded HTTP Headers
cloudfoundry-identity-server is vulnerable to forwarded http headers. There is an issue with forwarded http headers in UAA that can result in an account being corrupted...
Privilege Escalation
CloudFoundry User Account and Authentication UAA is vulnerable to privilege escalation attacks. These attacks are possible because any user is able to access the invitations endpoint. Through the endpoint, malicious users are able to perform a password reset on a different user...
Blind SQL Injection
CloudFoundry User Account and Authentication UAA is vulnerable to blind SQL injections. A malicious user cause a blind SQL injection when executing a simple query to the user database...
Privilege Escalation
CloudFoundry User Account and Authentication UAA is vulnerable to privilege escalation. A malicious user can pass a malicious user token to an unused group endpoint to cause an escalation of privileges...
Blind SQL Injection
CloudFoundry User Account and Authentication UAA is vulnerable to blind SQL injection attacks. The attacks are possible because it does not properly validate the clientid string...
Session Fixation Attacks
CloudFoundry User Account and Authentication UAA is vulnerable to session fixation attacks. These attacks are possible when UAA is configured to authenticate against OpenID Connect or external SAML based identity providers...