GHSA-292x-hjr8-226f

Source

https://github.com/advisories/GHSA-292x-hjr8-226f

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-292x-hjr8-226f/GHSA-292x-hjr8-226f.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-292x-hjr8-226f

Aliases

CVE-2018-15761

Published

2022-05-13T01:34:08Z

Modified

2024-12-07T05:27:49.809497Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Cloud Foundry UAA Privilege Escalation

Details

Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their privileges.

Database specific

{
    "nvd_published_at": "2018-11-19T14:29:00Z",
    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-01T23:42:43Z"
}

References

Affected packages

Maven / org.cloudfoundry.identity:cloudfoundry-identity-server

Package

Name: org.cloudfoundry.identity:cloudfoundry-identity-server; View open source insights on deps.dev
Purl: pkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.23.0

Affected versions

3.*

3.0.0

3.0.1

3.1.0

3.2.0

3.2.1

3.3.0

3.3.0.1

3.3.0.2

3.3.0.3

3.3.0.4

3.3.0.5

3.4.0

3.4.2

3.4.3

3.4.4

3.4.5

3.5.0

3.6.0

3.7.0

3.7.3

3.8.0

3.9.0

3.9.1

3.10.0

3.12.0

3.13.0

3.15.0

3.16.0

3.18.0

3.19.0

3.20.0

4.*

4.1.0

4.2.0

4.3.0

4.4.0

4.5.0

4.5.6

4.5.7

4.5.8

4.5.9

4.6.0

4.6.1

4.7.0

4.7.1

4.7.2

4.7.4

4.7.5

4.7.6

4.8.0

4.8.2

4.8.3

4.9.0

4.10.0

4.10.1

4.10.2

4.11.0

4.12.0

4.12.1

4.12.2

4.12.3

4.12.4

4.13.0

4.13.1

4.13.3

4.13.4

4.14.0

4.15.0

4.16.0

4.17.0

4.18.0

4.19.0

4.19.2

4.20.0

4.21.0

4.22.0