GHSA-292x-hjr8-226f

Suggest an improvement
Source
https://github.com/advisories/GHSA-292x-hjr8-226f
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-292x-hjr8-226f/GHSA-292x-hjr8-226f.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-292x-hjr8-226f
Aliases
Published
2022-05-13T01:34:08Z
Modified
2024-12-07T05:27:49Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Cloud Foundry UAA Privilege Escalation
Details

Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their privileges.

Database specific 
{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-03-01T23:42:43Z",
    "nvd_published_at":  "2018-11-19T14:29:00Z",
    "severity":  "HIGH"
}
References

Affected packages

Maven / org.cloudfoundry.identity:cloudfoundry-identity-server

Package

Name
org.cloudfoundry.identity:cloudfoundry-identity-server
View open source insights on deps.dev
Purl
pkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.23.0

Affected versions

3.*
3.0.0
3.0.1
3.1.0
3.2.0
3.2.1
3.3.0
3.3.0.1
3.3.0.2
3.3.0.3
3.3.0.4
3.3.0.5
3.4.0
3.4.2
3.4.3
3.4.4
3.4.5
3.5.0
3.6.0
3.7.0
3.7.3
3.8.0
3.9.0
3.9.1
3.10.0
3.12.0
3.13.0
3.15.0
3.16.0
3.18.0
3.19.0
3.20.0
4.*
4.1.0
4.2.0
4.3.0
4.4.0
4.5.0
4.5.6
4.5.7
4.5.8
4.5.9
4.6.0
4.6.1
4.7.0
4.7.1
4.7.2
4.7.4
4.7.5
4.7.6
4.8.0
4.8.2
4.8.3
4.9.0
4.10.0
4.10.1
4.10.2
4.11.0
4.12.0
4.12.1
4.12.2
4.12.3
4.12.4
4.13.0
4.13.1
4.13.3
4.13.4
4.14.0
4.15.0
4.16.0
4.17.0
4.18.0
4.19.0
4.19.2
4.20.0
4.21.0
4.22.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-292x-hjr8-226f/GHSA-292x-hjr8-226f.json"