HighCVSS 7.5
EPSS 0.20%
Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs.
Product
cloudfoundry uaa release vulnerabilities
5 published CVES affecting cloudfoundry uaa release, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 5
- Critical
- 1
- High
- 2
- Medium
- 2
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest cloudfoundry uaa release CVEs
Newest publication first
-
-
HighCVSS 8.8 EPSS 1.3%
CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls.
-
CriticalCVSS 9.8 EPSS 0.59%
Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated malicious attacker could hijack the DNS entry for the dependency, and inject malicious code into the com...
-
MediumCVSS 6.1 EPSS 0.83%
Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wildcard in the redirect uri's subdomain, a remote malicious unauthenticated user can craft a phishing link to get a UAA acce...
-
MediumCVSS 6.5 EPSS 0.88%
Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by changing their email address to that of a different user.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.