CVE-2019-11293

CVE-2019-11293 concerns Cloud Foundry UAA releases prior to v74.10.0. When set to DEBUG, the service logs client_secret credentials sent as query parameters to the uaa.log file, enabling credential disclosure. A remote authenticated attacker could gain user credentials via the log file if authent...

CVE-2019-11278

CVE-2019-11278 affects Cloud Foundry UAA before 74.1.0. A remote attacker with the privileges client.write and groups.update can craft a SCIM query by injecting external input directly into SCIM, causing a leak of information that enables privilege escalation and potential control of UAA scopes. ...

CVE-2019-11290

Cloud Foundry UAA before version 74.8.0 logs all query parameters to Tomcat’s access log; if those parameters carry credentials, they are logged as well, causing information disclosure. The vulnerability affects Cloud Foundry UAA and CF deployment lineages prior to upgrades cited by Cloud Foundry...

CVE-2016-0732

The CVE-2016-0732 entry corresponds to a privilege-escalation vulnerability in the identity-zones feature of Cloud Foundry components. Affected products include Cloud Foundry v208–v229, UAA v2.0.0–v2.7.3 and v3.0.0, UAA-Release v2–v4, and Elastic Runtime v1.6.0–v1.6.13. The issue allows remote au...

CVE-2020-5402

The CVE-2020-5402 issue affects Cloud Foundry UAA (and related deployments) where versions prior to 74.14.0 allow CSRF via the OAuth2 state parameter not being validated in the external identity provider callback. The core vulnerability is a missing check in the callback flow, impacting authentic...