CVE-2018-11041 Cloud Foundry UAA open redirect
MediumCVSS 6.1
EPSS 0.84%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open redirects. A remote attacker can craft a malicious link that, when clicked, will redirect users to arbitrary websites after a successful login attempt.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | < 4.7.5 | 4.7.5 |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.0.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.0.1 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.1.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.10.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.12.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.13.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.15.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.16.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.18.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.19.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.2.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.2.1 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.20.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.3.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.3.0.1 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.3.0.2 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.3.0.3 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.3.0.4 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.3.0.5 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.4.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.4.2 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.4.3 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.4.4 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.4.5 | No fix listed |
Show 50 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.5.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.6.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.7.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.7.3 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.8.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.9.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 3.9.1 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.1.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.2.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.3.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.4.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.5.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.5.6 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.5.7 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.5.8 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.5.9 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.6.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.6.1 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.7.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.7.1 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.7.2 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.7.4 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | >= 4.8.0, < 4.10.1 | 4.10.1 |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.10.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.8.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.8.2 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.8.3 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.9.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | >= 4.11.0, < 4.12.3 | 4.12.3 |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.11.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.12.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.12.1 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.12.2 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | >= 4.13.0, < 4.19.0 | 4.19.0 |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.13.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.13.1 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.13.3 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.13.4 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.14.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.15.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.16.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.17.0 | No fix listed |
| org.cloudfoundry.identity/cloudfoundry-identity-server(Maven) | = 4.18.0 | No fix listed |
| pivotal software cloud foundry uaa | >= 4.6.0, < 4.7.5 | 4.7.5 |
| pivotal software cloud foundry uaa | >= 4.7.5, < 4.10.1 | 4.10.1 |
| pivotal software cloud foundry uaa | >= 4.10.1, < 4.19.0 | 4.19.0 |
| pivotal software cloud foundry uaa-release | >= 48, < 52.9 | 52.9 |
| pivotal software cloud foundry uaa-release | >= 52.9, < 55.1 | 55.1 |
| pivotal software cloud foundry uaa-release | >= 55.1, < 60 | 60 |
| Cloud Foundry UAA | = later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- github.com product
- www.cloudfoundry.org third-party-advisory
- github.com