Privilege Escalation

CloudFoundry User Account and Authentication UAA is vulnerable to privilege escalation. A malicious user can pass a malicious user token to an unused group endpoint to cause an escalation of privileges...

Blind SQL Injection

CloudFoundry User Account and Authentication UAA is vulnerable to blind SQL injection attacks. The attacks are possible because it does not properly validate the clientid string...

Session Fixation Attacks

CloudFoundry User Account and Authentication UAA is vulnerable to session fixation attacks. These attacks are possible when UAA is configured to authenticate against OpenID Connect or external SAML based identity providers...

Denial Of Service (DoS)

CloudFoundry User Account and Authentication UAA is vulnerable to denial of service DoS attacks. These attacks are possible through the lockout feature...