CVE-2018-15761

Cloud Foundry UAA includes a privilege-escalation vulnerability in releases prior to v64.0 and in UAA prior to 4.23.0. A validated error lets a remote authenticated attacker modify the URL and content of the consent page to obtain a token with arbitrary scopes, escalating privileges. Exploitation...

CVE-2018-11082

CVE-2018-11082 affects Cloud Foundry UAA: versions prior to 4.20.0 and uaa-release prior to 61.0 allow brute-forcing of MFA codes. A remote, unauthenticated attacker with a valid username/password can brute force MFA to log in as the targeted user. Mitigations provided by Cloud Foundry include up...